trzor-io-start-authh[.]typedream[.]app

This domain, trzor-io-start-authh.typedream.app, is currently active and engaged in credential harvesting phishing operations specifically targeting users of the Trezor hardware wallet platform. Analysis indicates the site presents itself as an official Trezor authentication portal, using the page title 'Trézor.io/Start® | Starting Up Your Device - Trézor' to deceive victims into entering sensitive recovery phrases or private keys. Infrastructure analysis reveals the domain is hosted on Typedream's platform and resolves to the IP address 188.114.97.3. The SSL certificate is issued by Google Trust Services, providing a false sense of legitimacy. At the time of analysis, the domain was flagged by 2 of 95 security vendors on VirusTotal, indicating limited detection coverage. The registrar, Typedream, appears to be used as a hosting provider rather than a traditional domain registrar, which is consistent with observed patterns in phishing infrastructure where legitimate hosting services are abused to deploy malicious content. The site remains active and poses an elevated risk to users who may mistake it for the legitimate Trezor authentication portal. Organizations should immediately block access to this domain and its associated IP address. Users who may have interacted with this site should consider their recovery phrases or private keys compromised and take immediate steps to secure their assets, including generating new recovery phrases and transferring assets to new wallet addresses. Security teams are advised to monitor for similar domains utilizing the same hosting provider and IP range, as this may indicate a broader campaign.