help--us--public--trezor-io-start-cdn[.]typedream[.]app

This domain, help--us--public--trezor-io-start-cdn.typedream.app, is flagged as a high-risk brand impersonation threat targeting Trezor, a cryptocurrency hardware wallet provider. Analysis indicates the infrastructure is designed to mimic the official Trezor setup process, likely to facilitate credential theft or crypto drainer attacks. The page title, "Trézor.io/start® | Starting Up Your Device | Trézor®," closely replicates the legitimate brand’s onboarding flow, increasing the likelihood of user deception. Infrastructure analysis reveals multiple technical indicators of compromise. The domain was registered on June 15, 2026, through Typedream, a platform not associated with the legitimate Trezor brand. It resolves to the IP address 188.114.97.3 and is secured with an SSL certificate issued by Google Trust Services (WE1). Security vendors have flagged the domain in 18 out of 95 VirusTotal scans, and it appears on three security blocklists, including PhishDestroy, MetaMask, and SEAL. Google Safe Browsing (GSB) status is not explicitly provided, but the presence on multiple blocklists suggests active malicious classification. The domain remains active and poses a significant risk to users attempting to initialize Trezor devices. Response actions should include immediate blacklisting by security providers, takedown requests to the registrar, and public advisories to warn potential victims. Despite these measures, the infrastructure’s persistence and the use of a legitimate-looking SSL certificate indicate a sophisticated threat actor. Users are advised to verify domain authenticity via official channels and avoid interacting with any non-Trezor-verified setup pages.