sso-faq-trezor-eng-public[.]typedream[.]app

The domain sso-faq-trezor-eng-public.typedream.app is actively engaged in brand impersonation targeting Trezor, a cryptocurrency hardware wallet provider. Analysis indicates this is a credential theft operation, designed to harvest login credentials from users under the guise of an official Trezor login portal. The domain remains operational as of this report, with no indications of takedown or mitigation efforts. Infrastructure analysis reveals the domain resolves to the IP address 188.114.96.3, a host associated with content delivery networks and known to be leveraged in phishing campaigns. The domain is flagged by 5 of 95 security vendors on VirusTotal, indicating a moderate but concerning detection rate. The SSL certificate is issued by Google Trust Services, a legitimate provider, which may lend an air of authenticity to the fraudulent page. The page title, 'Trezor @Login | The official wallet*,' explicitly mimics Trezor’s branding, further corroborating the credential theft objective. No registrar or creation date details are publicly available for this subdomain, as it is hosted on a platform-as-a-service provider, which complicates attribution and enforcement actions. Current risk assessment classifies this campaign as elevated due to the targeted nature of the impersonation and the potential for significant financial loss to victims. Users are strongly advised to verify the authenticity of any login portal by cross-referencing the URL with official sources and avoiding interaction with unsolicited links. Organizations should update blocklists to include this domain and its associated IP address, while monitoring for similar subdomain patterns under the typedream.app namespace. Security teams are encouraged to conduct retrospective analysis of network logs for connections to 188.114.96.3 to identify potential prior compromises.