faq-public-trzor-suit[.]typedream[.]app

The domain faq-public-trzor-suit.typedream.app is identified as a high-risk brand impersonation threat targeting Trezor. The domain attempts to deceive users by mimicking Trezor's legitimate services, potentially leading to credential theft or unauthorized access to users' cryptocurrency accounts. The page title 'Trezor.io/Start® | Trezor Suite App (Official) | Trezor®' is crafted to appear authentic and mislead users into believing it is associated with the official Trezor platform.

Technical analysis of the domain reveals several indicators of compromise. The domain is flagged by 18 out of 95 security vendors on VirusTotal, indicating a significant detection rate. It is registered through Typedream and resolves to the IP address 172.67.206.36, which is associated with Cloudflare's infrastructure in the United States (AS13335). The SSL certificate in use is issued by Google Trust Services / WE1. This domain is currently listed on three security blocklists and has been blocked by security tools such as PhishDestroy, MetaMask, and SEAL.

The domain is currently active and poses a high risk to users, particularly those seeking to access Trezor services. It is crucial for users to be cautious and verify the legitimacy of sites claiming to be affiliated with Trezor. Security professionals should ensure that this domain is blocked within their networks to prevent potential breaches. Continuous monitoring and reporting of such phishing domains are recommended to mitigate the risk of further impersonation threats.