wel-trezor-login-ai[.]typedream[.]app

This domain is a credential harvesting portal designed to impersonate Trezor, a hardware cryptocurrency wallet provider. The site presents a fraudulent login interface titled 'Trezor @Login - Secure Access to Your Trezor®,' tricking users into entering sensitive wallet credentials, recovery seeds, or private keys. Such attacks enable threat actors to gain unauthorized access to cryptocurrency wallets, leading to immediate asset theft. The site’s design and branding closely resemble official Trezor properties, increasing the likelihood of successful deception, particularly among users unfamiliar with legitimate authentication flows. Analysis indicates the domain was registered on June 15, 2026, through Typedream, a platform that enables rapid deployment of web pages without stringent verification. It resolves to the IP address 188.114.96.3 and uses an SSL certificate issued by Google Trust Services (WE1), which may lend a false sense of legitimacy. The domain is flagged by 18 out of 95 security vendors on VirusTotal and appears on three security blocklists, including PhishDestroy, MetaMask, and SEAL. The creation date discrepancy (2026) suggests potential domain spoofing or incorrect registration metadata, a common tactic in phishing infrastructure. If a user has visited wel-trezor-login-ai.typedream.app and entered credentials or recovery information, immediate action is required. First, disconnect any connected devices from the internet to prevent further data exfiltration. Next, assume the credentials or seeds are compromised and transfer all assets from the affected wallet to a new, secure wallet with a fresh recovery phrase. Enable multi-factor authentication on all associated accounts and monitor for unauthorized transactions. Report the incident to the legitimate service provider and relevant cybersecurity authorities to aid in takedown efforts and prevent further victimization.