io-suitetrezr-en[.]typedream[.]app

This domain, io-suitetrezr-en.typedream.app, poses a high-risk brand impersonation threat specifically targeting users of the Trezor cryptocurrency hardware wallet. The phishing page mimics the official Trezor Suite application interface, presenting itself as the legitimate "Trezor Suite App (Official) | Desktop & Web Crypto Management" platform. Analysis indicates the site was designed to harvest sensitive credentials, including wallet recovery seeds, private keys, or other authentication details, by deceiving users into believing they are interacting with a trusted service. The use of official branding elements, combined with a seemingly legitimate page title and infrastructure, increases the likelihood of successful social engineering attacks against unsuspecting victims. Evidence supporting the malicious classification of this domain includes detection by 17 out of 95 security vendors on VirusTotal, as well as its presence on three independent security blocklists. The domain was registered through Typedream, a platform that enables rapid deployment of web pages, which is frequently abused for phishing campaigns due to its ease of use and low barrier to entry. Infrastructure analysis reveals the domain resolves to the IP address 172.67.206.36, which is associated with a content delivery network known for obfuscating the origin of malicious traffic. The SSL certificate is issued by Google Trust Services, providing a false sense of security to visitors. Additional technologies detected on the site include Node.js, React, Next.js, and multiple Google Cloud services, which are consistent with the infrastructure used by legitimate applications but are also commonly exploited in phishing operations. Users who visited io-suitetrezr-en.typedream.app should assume their credentials or sensitive information may have been compromised. Immediate action is required, including revoking any active sessions, changing passwords, and regenerating wallet recovery seeds if any information was entered on the site. Affected individuals should also monitor their accounts for unauthorized transactions and enable multi-factor authentication where available. Given the high-risk nature of this campaign, users are advised to verify the authenticity of any cryptocurrency-related websites by cross-referencing official domains and avoiding links from untrusted sources. Security teams should update blocklists to include this domain and its associated IP address to prevent further exposure.