login-trezor-cdn-sso-us[.]typedream[.]app

This domain, login-trezor-cdn-sso-us.typedream.app, is flagged as a high-risk brand impersonation resource targeting Trezor, a cryptocurrency hardware wallet provider. Analysis indicates the site mimics a legitimate single sign-on (SSO) or content delivery network (CDN) endpoint, using a subdomain structure designed to deceive users into entering credentials. The page title, 'Trezor @Login| Sing In*,' further reinforces the impersonation attempt by presenting a fabricated authentication interface. No direct association with known drainer kits has been confirmed at this time, though the domain’s behavior aligns with credential harvesting objectives. Infrastructure analysis reveals the following technical indicators: the domain resolves to the IP address 188.114.97.3 and is hosted under the typedream.app parent domain, registered through Namecheap, Inc. As of the latest assessment, VirusTotal reports 3 out of 95 security vendors detecting the domain as malicious. The SSL certificate is issued by Google Trust Services, providing a superficial layer of legitimacy. No Google Safe Browsing (GSB) warnings were observed at the time of analysis, though this does not preclude prior or future flagging. The domain’s creation date is not publicly disclosed, limiting temporal attribution. Blocklist monitoring services indicate minimal inclusion, suggesting either recent deployment or evasion tactics. The domain remains active, with no evidence of takedown or mitigation. Response actions by the hosting provider or registrar have not been observed, and the site continues to serve content impersonating Trezor’s authentication portal. Remaining risk is classified as high due to the combination of active credential harvesting, low detection rates, and the absence of enforcement measures. Users are advised to verify domain authenticity through official channels and avoid entering sensitive information on unverified platforms. Organizations should monitor for similar subdomain abuse patterns under the typedream.app namespace and update detection rules accordingly.