faqspublictrzors[.]typedream[.]app

The domain faqspublictrzors.typedream.app is actively engaged in brand impersonation, specifically targeting Trezor, a well-known cryptocurrency hardware wallet provider. This domain is currently classified as active and poses an elevated risk to users by mimicking official Trezor resources, potentially leading to unauthorized access to cryptocurrency assets or credential theft. Analysis indicates the threat is focused on deceiving users into interacting with fraudulent infrastructure under the guise of legitimate services. Infrastructure analysis reveals that the domain is registered through Typedream and resolves to the IP address 188.114.97.3. It has been flagged by 2 of 95 security vendors on VirusTotal, indicating detection by specialized threat intelligence systems. The domain appears on three security blocklists, further corroborating its malicious intent. The SSL certificate is issued by Google Trust Services, which, while providing encryption, does not validate the legitimacy of the site’s content. The page title, "Trezor.io/Start® | Trezor Suite App (Official) | Trezor®," is designed to closely resemble Trezor’s official branding, enhancing its deceptive appearance. Current status confirms the domain remains active and operational, continuing to pose a threat to unsuspecting users. Organizations and individuals are advised to block access to this domain at the network level and update endpoint protection systems to include this indicator of compromise. Users should verify the authenticity of any Trezor-related communications by accessing official channels directly through verified URLs. Cryptocurrency holders are urged to exercise heightened caution, particularly when prompted to enter sensitive information or download software from unverified sources. Monitoring for additional indicators of compromise, such as unusual network traffic to the IP 188.114.97.3, is recommended to mitigate potential risks.