support-trezor-io-start-starting-cdn[.]typedream[.]app

The domain support-trezor-io-start-starting-cdn.typedream.app has been identified as a high-risk brand impersonation threat targeting Trezor, a cryptocurrency hardware wallet provider. Analysis confirms the domain is currently offline, though it previously hosted content designed to deceive users into believing they were accessing legitimate Trezor setup pages. The threat type is specifically classified as brand impersonation, with no evidence of credential theft or crypto drainer functionality at this time, though such capabilities cannot be ruled out in prior iterations. Infrastructure analysis reveals the domain was registered through Typedream on June 15, 2026, and resolved to the IP address 188.114.96.3. Security vendors flagged the domain in 17 of 95 VirusTotal scans, indicating moderate detection coverage. The domain appears on four security blocklists, including MetaMask, PhishDestroy, SEAL, and OISD. The SSL certificate is issued by Google Trust Services, a common tactic to lend false legitimacy to malicious infrastructure. The page title, 'Trezor.io/Start® | Starting Up Your Device | Trézór®,' closely mimics official Trezor branding, including the use of registered trademark symbols to enhance credibility. Current status indicates the domain has been taken offline, reducing immediate risk to end users. However, the infrastructure remains registered and could be reactivated. Organizations and individuals are advised to block the domain and associated IP address at the network level. Users who may have interacted with the domain should verify their device integrity, review connected wallet addresses for unauthorized changes, and monitor for unusual transaction activity. Security teams should treat any prior engagement with this domain as a potential compromise and conduct appropriate forensic analysis on affected systems.