faq-trezor-loginoverview[.]typedream[.]app

This domain, faq-trezor-loginoverview.typedream.app, poses a targeted brand impersonation threat against Trezor hardware wallet users. The site mimics the official Trezor login interface, presenting a page titled 'Trezor @Login - Secure Access to Your Trezor®' to deceive victims into entering sensitive credentials, including wallet recovery seeds or private keys. Analysis indicates the domain is designed to harvest authentication details, which could lead to unauthorized access to cryptocurrency wallets and immediate financial loss. The impersonation extends to visual and textual elements, closely replicating Trezor’s branding to lower user suspicion during interaction. Evidence supporting the malicious nature of this domain includes detection by 18 out of 95 security vendors on VirusTotal, with two independent blocklists (PhishDestroy and PhishingDB) already listing it. Infrastructure analysis reveals the domain is hosted on Cloudflare’s network, resolving to IP address 188.114.96.3 (AS13335, Cloudflare, Inc.), a common obfuscation tactic to conceal the true origin of the threat. The SSL certificate, issued by Google Trust Services (WE1), further mimics legitimacy while providing no inherent security against the underlying phishing scheme. The domain was registered through Cloudflare’s registrar service, which is frequently exploited for rapid deployment of fraudulent sites due to its accessibility and privacy features. Users who have visited faq-trezor-loginoverview.typedream.app or entered credentials on this portal should immediately revoke access to any associated Trezor wallets and initiate recovery procedures using an official, verified Trezor interface. All potentially exposed credentials, including passwords and recovery seeds, must be considered compromised and replaced. Monitor linked accounts for unauthorized transactions and enable multi-factor authentication where available. If financial assets were transferred to this domain, report the incident to relevant financial authorities and blockchain analysis services to trace or freeze stolen funds. Avoid interacting with the domain further, and update local security controls to block the domain and its resolving IP address (188.114.96.3) across all network layers.