info-trezurr-start-io[.]typedream[.]app

The domain info-trezurr-start-io.typedream.app is identified as a high-risk brand impersonation threat targeting Trezor, a cryptocurrency hardware wallet provider. This domain was designed to deceive users into believing they were accessing an official Trezor resource, specifically the Trezor Suite App initiation page. The page title, "Trezor.io/Start® | Trezor Suite App (Official) | Trezor®," closely mimics legitimate branding to exploit user trust. The domain is currently offline, but prior activity indicates malicious intent. Analysis indicates the domain was flagged by 16 of 95 security vendors on VirusTotal, reflecting broad detection across multiple threat intelligence platforms. Infrastructure analysis reveals the domain was registered through Typedream and resolved to the IP address 172.67.206.36. The SSL certificate was issued by Google Trust Services, which, while not inherently malicious, is often leveraged by threat actors to lend a false sense of legitimacy. The domain appears on three security blocklists and was actively blocked by MetaMask, PhishDestroy, and SEAL. Gridinsoft assigned a trust score of 0/100, further corroborating its malicious classification. The domain has been taken offline, but users who may have interacted with it should assume potential compromise of sensitive credentials or cryptocurrency assets. It is recommended to revoke any active sessions, rotate passwords, and monitor financial accounts for unauthorized transactions. Organizations should update blocklists to include this domain and its associated IP address. Users are advised to verify the authenticity of any Trezor-related communications by accessing official resources directly through verified channels, such as the legitimate Trezor.io domain. Proactive monitoring for similar impersonation domains is strongly encouraged.