start-trezoo-io-faq[.]typedream[.]app

The domain start-trezoo-io-faq.typedream.app has been identified as a high-risk brand impersonation resource actively targeting users of the Trezor hardware wallet service. Analysis confirms the domain is operational, presenting itself as an official Trezor support or setup portal with the page title "Trezór.io/Start® | | Starting Up Your Device | Trézór® | Trezor.io/sta." This activity aligns with known tactics used to deceive users into disclosing sensitive credentials or installing malicious software under the guise of legitimate device initialization procedures. Infrastructure analysis reveals the domain is hosted on the typedream.app platform and resolves to the IP address 188.114.96.3. Detection metrics indicate limited but concerning coverage, with 2 of 95 security vendors on VirusTotal flagging the domain as malicious. The SSL certificate is issued by Google Trust Services, providing a veneer of legitimacy while failing to mitigate the underlying threat. No historical registration data or creation date is publicly available for this subdomain, though the parent platform (typedream.app) is managed through Namecheap, Inc. as the registrar. No additional blocklist entries or trust scores were identified in aggregated threat intelligence feeds at the time of assessment. The domain remains active as of this report, posing an ongoing risk to users attempting to initialize Trezor devices. Immediate mitigation steps are recommended, including blocking the domain and IP at network perimeter controls, updating endpoint detection rules to include the observed indicators, and alerting user bases to verify official sources before engaging with setup instructions. Organizations should monitor for related subdomains under the typedream.app namespace, as this pattern may indicate a broader campaign leveraging platform-as-a-service infrastructure for rapid deployment and evasion.