sso-trezor-com--x--auth[.]typedream[.]app

Analysis of sso-trezor-com--x--auth.typedream.app shows a high‑risk brand impersonation campaign targeting Trezor users. The domain resolves to 188.114.96.3, an address owned by AS13335 Cloudflare, Inc. in the United States, and the site returned an HTTP 404 response at the time of collection, indicating the payload is currently taken offline. The page title reported by the scanner matches the official Trezor branding – "Trezor.io/Start® - Starting Up Your Device — Trezor®" – confirming that the threat actors deliberately duplicated legitimate content to lure victims. Technical fingerprints reveal a modern web stack consisting of Node.js, React, Next.js, and Google Cloud services behind a Cloudflare CDN, all typical of legitimate sites but also exploited to host the malicious front end.

The SSL certificate is issued by Google Trust Services (WE1), providing a valid TLS handshake that may obscure the malicious nature of the domain. VirusTotal recorded 14 detections out of 95 scanned security vendors, reinforcing the classification as a crypto‑related scam. Independent blocklist feeds have listed the domain on three separate blocklists, and active defenses such as PhishDestroy, MetaMask, and SEAL have already blocked it. Registration information shows the domain was provisioned through Cloudflare, Inc., with no publicly visible nameserver entries.

While the exact phishing page content has not been captured, the convergence of brand‑specific page title, legitimate‑looking infrastructure, and multiple vendor detections indicates a coordinated impersonation effort. Defenders should continue to block the domain at DNS and proxy layers, monitor for any resurgence of the site, and enforce strict outbound traffic controls to known Trezor endpoints. Incident response teams should also flag any authentication attempts to this hostname as suspicious and consider user awareness campaigns that highlight the risk of unsolicited Trezor‑related URLs.