trezor-bridge-trezor-bridge-us[.]typedream[.]app

This domain, trezor-bridge-trezor-bridge-us.typedream.app, is an active impersonation site targeting users of a cryptocurrency hardware wallet. The site mimics the official wallet bridge interface, presenting a page titled 'Trézór Bridge® | Introducing the New Trézór App' to deceive visitors into entering sensitive credentials, such as recovery seeds or private keys. Such attacks are designed to exfiltrate authentication details, enabling unauthorized access to digital assets stored in hardware wallets. The use of a legitimate-sounding subdomain and brand-specific terminology increases the likelihood of successful deception, particularly among users unfamiliar with official communication channels. Analysis indicates the domain is hosted on infrastructure associated with the Typedream platform, a service that allows users to create and deploy websites without extensive technical knowledge. The site resolves to the IP address 188.114.97.3, and its SSL certificate is issued by Google Trust Services, which may lend an appearance of legitimacy to unsuspecting users. Detection metrics from VirusTotal reveal that 2 out of 95 security vendors have flagged this domain as malicious, specifically for brand impersonation and phishing activities. The low detection count suggests the campaign may still be in an early or evasive phase, potentially avoiding broader scrutiny by security tools. Users who have visited this domain or interacted with its content should assume their credentials may have been compromised. Immediate steps include disconnecting any devices that accessed the site from the internet and ceasing all further interaction with the domain. Affected individuals should initiate a full security review of their wallet and associated accounts, including generating new recovery seeds and transferring assets to a new, secure wallet. Monitoring for unauthorized transactions is critical, and any suspicious activity should be reported to the official support channels of the targeted brand. Additionally, users are advised to verify the authenticity of any communication or software updates by cross-referencing with the official domain and documentation.