en-trezo-secure-faq[.]typedream[.]app

Risk level: high. This domain is a confirmed brand impersonation site specifically designed to mimic Trezor, a cryptocurrency hardware wallet provider. The threat type is brand impersonation with phishing intent, as indicated by the page title Trezor.io/Start | Starting Up Your Device - Trezor, which directly copies official Trezor branding to deceive users into entering sensitive credentials or seed phrases.

Technical indicators: VirusTotal analysis shows 2 out of 95 security vendors flagging the domain as malicious. The SSL certificate is issued by Google Trust Services, a legitimate CA, which increases the deceptive appearance. The domain resolves to IP 188.114.97.3, currently active and serving the phishing page. Registration information indicates the domain was created via Typedream, a website builder, and is not associated with the legitimate Trezor organization. This domain is absent from major blocklists at the time of analysis, but its recent registration and low detection rate suggest it is a fresh threat. Trust scores from community sources are low due to the impersonation pattern and lack of legitimate ownership.

Mitigation steps specific to brand impersonation: Users should verify the URL against official Trezor domains (trezor.io). Never enter seed phrases, passwords, or recovery keys on any page accessed via unsolicited links. Browser security extensions should block this domain. IT administrators should add en-trezo-secure-faq.typedream.app to DNS blocklists and email filters. Report the domain to Google Safe Browsing and the hosting provider (Cloudflare) for takedown. Monitor for similar domains using the seed d2046c to detect future variants.