faq-trezor-loginn[.]typedream[.]app

This domain, faq-trezor-loginn.typedream.app, is actively engaged in brand impersonation targeting Trezor, a cryptocurrency hardware wallet provider. The threat type is classified as credential theft through brand impersonation, with the domain currently operational and serving malicious content. Analysis confirms the domain is designed to deceive users into disclosing sensitive authentication details by mimicking Trezor’s official login interface. Infrastructure analysis reveals the domain resolves to the IP address 188.114.96.3 and is hosted on infrastructure managed by Typedream. The SSL certificate is issued by Google Trust Services, a common tactic to lend legitimacy to fraudulent sites. VirusTotal detection indicates that 2 out of 95 security vendors have flagged this domain as malicious. The page title, 'Trezor @Login - Secure Access to Your Trezor®,' further corroborates the intent to impersonate the legitimate Trezor login portal. No historical registration data or additional blocklist entries were provided, limiting further temporal analysis. The domain remains active as of the latest verification, posing a high risk to users unfamiliar with Trezor’s official authentication channels. Immediate mitigation steps include blocking the domain and associated IP (188.114.96.3) at the network perimeter, adding the domain to enterprise and endpoint blocklists, and alerting users to verify the authenticity of any Trezor-related login pages. Organizations should monitor for credential reuse attempts stemming from this campaign and enforce multi-factor authentication where possible to mitigate account compromise risks.