faqs-auth-trzor-sso[.]typedream[.]app

The domain faqs-auth-trzor-sso.typedream.app was identified as a high-risk brand impersonation site targeting Trezor, a cryptocurrency hardware wallet provider. This domain specifically impersonated Trezor’s official support and authentication pages, likely to deceive users into disclosing sensitive credentials or installing malicious software. Analysis confirms the domain is currently offline, though it previously hosted a fraudulent page titled 'Trezor® Hardware Wallet | Step-by-Step Getting Started | Trezor™,' designed to mimic legitimate onboarding documentation. Technical indicators reveal the domain was flagged by 20 of 95 security vendors on VirusTotal, indicating widespread detection as malicious. It was registered through Typedream, a platform often exploited for rapid deployment of phishing infrastructure. The domain resolved to the IP address 188.114.96.3 and was hosted on infrastructure utilizing Node.js, React, Next.js, and Google Cloud services, including Cloud Trace and CDN. Additional telemetry shows the domain appeared on three security blocklists and was actively blocked by MetaMask, PhishDestroy, and SEAL. The SSL certificate was issued by Google Trust Services, a common tactic to lend false legitimacy to phishing sites. Gridinsoft assigned the domain a trust score of 0/100, further corroborating its malicious classification. As of the latest assessment, the domain has been taken offline, reducing immediate risk to users. However, similar infrastructure may still be active under different domains. Users who interacted with this domain should immediately revoke any connected wallet permissions, rotate credentials, and scan systems for malware. Organizations are advised to update blocklists with the domain and associated IP, monitor for related subdomains or typosquatting variants, and educate users on recognizing brand impersonation tactics in cryptocurrency contexts. Security teams should investigate logs for connections to 188.114.96.3 or requests to faqs-auth-trzor-sso.typedream.app to identify potential compromise.