trezor-login-web[.]typedream[.]app

trezor-login-web.typedream.app was registered on February 21, 2026 through Squarespace Domains II LLC. The site is currently offline, returning an HTTP 404 response. Cloudflare DNS resolves the hostname to 104.21.37.85, an address owned by AS13335 Cloudflare, Inc., located in the United States. The TLS certificate is issued by Google Trust Services under the WE1 designation, indicating a valid HTTPS endpoint despite the missing content. Automated analysis on VirusTotal shows 21 of 93 scanners flagging the domain as malicious, and the hostname appears on three public blocklists.

It is actively blocked by PhishDestroy, MetaMask, and SEAL, confirming that multiple threat‑intelligence feeds consider it a credential‑harvesting vector. The page title reported by crawlers reads “Trezor Wallet: Secure Your Crypto with Cold Storage,” directly referencing the Trezor brand, and the threat classification is recorded as a crypto‑scam. Technology fingerprinting identifies a stack comprising Node.js, React, Next.js, Google Cloud services, Cloudflare CDN, and Webpack, a common combination for fast‑deployment phishing kits. The available telemetry does not disclose the specific phishing page content or any login capture mechanism, so the exact user‑experience remains unknown.

Defenders should continue to block the hostname at network layers, add the IP address 104.21.37.85 to deny lists, and monitor for any re‑hosting of the same content on alternative domains. Organizations using Trezor hardware wallets should advise users to verify URLs against official trezor.io domains and to employ browser anti‑phishing extensions that recognise the listed blocklists. Ongoing observation of the registrar and DNS records is recommended in case the domain is re‑activated.