welcome-faq-io-trezr[.]typedream[.]app

This domain, welcome-faq-io-trezr.typedream.app, is flagged as a high-risk brand impersonation threat targeting Trezor, a cryptocurrency hardware wallet provider. Analysis of the page title, "Trezor.io/Start® | Trezor Suite App (Official) | Trezor®," confirms the intent to deceive users into believing they are accessing the legitimate Trezor onboarding portal. The domain mimics official branding to facilitate credential harvesting or malware distribution, a common tactic in cryptocurrency-related phishing operations. Infrastructure analysis reveals the domain was registered through Typedream and resolves to the IP address 188.114.96.3. Detection metrics indicate limited but targeted flagging, with 3 out of 95 security vendors on VirusTotal identifying the domain as malicious. The domain appears on three security blocklists, including PhishDestroy and MetaMask, while Gridinsoft assigns it a trust score of 0/100. The SSL certificate is issued by Google Trust Services, a legitimate provider, which may reduce user suspicion despite the domain's malicious intent. No specific creation date is provided, but the active status and detection patterns suggest recent deployment. As of the latest assessment, welcome-faq-io-trezr.typedream.app remains active, posing an ongoing risk to users. The domain leverages modern web technologies, including Node.js, React, Next.js, and Google Cloud infrastructure, to enhance its appearance of legitimacy. Organizations and individuals are advised to block the domain at the network level and update endpoint protection rules to prevent access. Users should verify the authenticity of Trezor-related communications by cross-referencing official channels and avoiding interaction with unsolicited links or domains.