trezor-bridge-web-sso[.]typedream[.]app

The domain trezor-bridge-web-sso.typedream.app was observed serving a page titled “Trézór Bridge® | Crypto* in Trèzōr™ Bridge™” and is classified as a wallet/seed phishing site that impersonates the hardware‑wallet brand Trezor. The domain resolves to the Cloudflare address 188.114.96.3, which belongs to AS13335 (Cloudflare, Inc.) and is geolocated to the United States. DNS resolution is handled by annalise.ns.cloudflare.com and darwin.ns.cloudflare.com, confirming the use of Cloudflare’s authoritative name servers. The TLS certificate is issued by Google Trust Services under the “WE1” profile, indicating a valid HTTPS endpoint despite the malicious intent.

An HTTP request to the host returns a 403 status code, suggesting the site is currently restricting access, and the latest intelligence reports the domain as taken offline. VirusTotal scanned the domain on 16 of 95 antivirus engines, all of which flagged it as malicious, reinforcing the phishing classification. The site appears on a single external blocklist and is specifically blocked by PhishDestroy, confirming that threat‑intel communities have already taken remediation steps. Technical fingerprints reveal a modern web stack: Node.js, React, Next.js, Google Cloud services (Trace, CDN), Cloudflare CDN, and Webpack, indicating a sophisticated deployment likely intended to mimic legitimate Trezor web resources.

Registration data shows the domain was created on 22 January 2021 through Squarespace Domains II LLC, a registrar commonly used for legitimate and malicious sites alike. No additional content analysis is available beyond the page title; the exact login flow, data capture mechanisms, and any embedded payloads remain unverified. Defenders should add the full domain name to DNS and proxy blocklists, monitor for any re‑hosting on alternative IPs or similar sub‑domains, and enforce strict validation of TLS certificates when users access Trezor‑related URLs.