help-trezor-io-staart[.]typedream[.]app

PhishDestroy identifies help-trezor-io-staart.typedream.app as an active crypto-asset drainer masquerading as the Trezor wallet brand. The domain leverages the trusted Trezor name to trick cryptocurrency holders into connecting wallets and signing malicious transactions that silently drain assets to attacker-controlled addresses. No publicly documented drainer kit payloads are listed in current sandboxes; however, the site’s workflow mimics legitimate Trezor login and transaction authorization pages, indicating a lightweight but effective impersonation framework designed for quick fund extraction. Historical campaigns frequently pair such domains with fake support tickets and phishing emails referencing “unauthorized access” to pressure victims into connecting their wallets. This domain was flagged by 12 of 95 VirusTotal security vendors at time of analysis. It resolves to IP 188.114.97.3 and is hosted on Typedream’s appspot, indicating a serverless landing page likely spun up for transient phishing campaigns. The domain uses a Google Trust Services SSL certificate, a tactic intended to bypass browser warnings and increase perceived legitimacy. Public blocklist monitoring shows 3 active detections across threat intelligence platforms, and the domain was created within the last 30 days. Google Safe Browsing has not yet assigned a verdict, leaving a narrow window for continued abuse before takedown measures take effect. PhishDestroy currently rates this domain as elevated risk and active. No public takedown advisories or hosting provider blocks have been confirmed at this time. Users are advised to avoid visiting the domain, verify any Trezor communications via official channels, and report suspicious links to PhishDestroy’s threat feed. Remaining risk is elevated due to the domain’s recent creation, transient hosting, and partial detection coverage; continued monitoring is strongly recommended until global blocklisting and certificate revocation are confirmed.