helps-trezoru-login[.]typedream[.]app

This domain, helps-trezoru-login.typedream.app, poses as the official Trezor hardware wallet login page to deceive users into entering sensitive credentials or cryptocurrency wallet information. Analysis indicates the site is designed to function as a crypto drainer, a type of malicious infrastructure that automatically siphons funds from connected wallets once access details are provided. The page title, "Trezor login® | Starting Up Your Device | Trezor®," closely mimics legitimate Trezor branding, increasing the likelihood of successful social engineering attacks against unsuspecting users.

Infrastructure analysis reveals the domain is registered through Typedream, a platform typically used for website creation, and remains active at the time of investigation. The domain resolves to the IP address 188.114.97.3, which has not been flagged by any of the 95 security vendors on VirusTotal, indicating either recent deployment or evasion techniques. The lack of detections (0/95) suggests the infrastructure may still be in the early stages of exploitation or employs obfuscation methods to avoid automated detection systems.

Users who have visited helps-trezoru-login.typedream.app or entered credentials on the site should immediately disconnect any connected wallets and revoke access to all dApps or services linked to the compromised credentials. It is critical to transfer remaining funds to a new, secure wallet address not associated with the exposed account. Additionally, monitor all connected accounts for unauthorized transactions and enable multi-factor authentication where available. If hardware wallet recovery phrases were entered, consider the device compromised and replace it entirely, as recovery phrases provide full access to wallet contents.