net-start-trezrio-x-doc[.]typedream[.]app

The domain net-start-trezrio-x-doc.typedream.app is actively engaged in brand impersonation, specifically targeting Trezor, a well-known cryptocurrency hardware wallet provider. This campaign is classified as elevated risk due to its deceptive practices, which aim to mislead users into interacting with fraudulent infrastructure under the guise of legitimate services. The domain remains operational as of the latest analysis, posing a continued threat to unsuspecting victims. Infrastructure analysis reveals that the domain is registered through Typedream, a platform that facilitates website creation. It resolves to the IP address 188.114.97.3, a host that has been associated with other suspicious activities. Detection metrics indicate that 4 of 95 security vendors on VirusTotal have flagged this domain as malicious, reflecting moderate but concerning consensus. The page title, "Trezor.io/Start® | Starting Up Your Device | Trezor®," explicitly mimics the official Trezor onboarding process, further corroborating the brand impersonation threat type. The SSL certificate is issued by Google Trust Services, which, while providing encryption, does not validate the legitimacy of the domain’s intent. Current assessments confirm that this domain remains active and poses a tangible risk to users seeking Trezor-related services. Organizations and individuals are advised to block access to this domain at the network level and update endpoint protection rules to include the identified IP address. Users should be educated on verifying domain authenticity before entering sensitive information, particularly in cryptocurrency-related workflows. Monitoring for similar domains registered through Typedream or resolving to the same IP may help preempt further campaigns leveraging this infrastructure.