manage-trezoor-learn-login[.]typedream[.]app

This domain, manage-trezoor-learn-login.typedream.app, operates as a credential harvesting portal impersonating Trezor, a hardware cryptocurrency wallet provider. The infrastructure presents a fraudulent login interface designed to deceive users into submitting sensitive account credentials, including wallet recovery phrases or private keys. The page title, "trezor®Log In | Sign In to Your Account*," mimics the legitimate Trezor authentication flow, increasing the likelihood of successful social engineering attacks against cryptocurrency holders. Analysis of the domain reveals multiple indicators of malicious activity. The domain is flagged by 11 out of 95 security vendors on VirusTotal, with additional detections on one security blocklist. Infrastructure analysis shows the domain is registered through Cloudflare, Inc., resolving to the IP address 188.114.96.3, which is associated with Cloudflare’s network (AS13335). The SSL certificate is issued by Google Trust Services (WE1), a common characteristic of both legitimate and malicious sites leveraging content delivery networks. The domain has since been taken offline, though prior activity suggests it was actively targeting users during its operational window. Users who interacted with this domain should assume their credentials or recovery phrases were compromised. Immediate action is required, including revoking access to any linked cryptocurrency wallets, generating new recovery phrases, and monitoring for unauthorized transactions. If financial assets were accessed or transferred, affected parties should report the incident to relevant authorities and cryptocurrency exchange support teams. Additionally, users should verify the authenticity of any communication claiming to originate from Trezor, as this domain may have been part of a broader phishing campaign.