help-troz-en-us[.]typedream[.]app

The domain help-troz-en-us.typedream.app is confirmed as an active phishing site targeting cryptocurrency users through brand impersonation of Trezor, a hardware wallet provider for Ethereum and other digital assets. Analysis indicates this is a credential and seed phrase harvesting operation, designed to deceive victims into disclosing sensitive wallet recovery information under the guise of a legitimate onboarding process. The page title "Trezor® Hardware Wallet | Step-by-Step Getting Started | Trezor™" directly mimics official Trezor documentation, increasing the likelihood of successful social engineering attacks against users seeking wallet setup guidance. Infrastructure analysis reveals the domain was registered through Squarespace Domains II LLC and currently resolves to IP address 104.21.37.85, hosted on AS13335 (Cloudflare, Inc.) with a US geolocation. The site is flagged by 20 of 95 security vendors on VirusTotal, appears on one security blocklist, and is actively blocked by at least one threat intelligence feed. The SSL certificate is issued by Google Trust Services (WE1), a common tactic to lend false legitimacy to phishing infrastructure. The domain creation date of February 21, 2026, suggests either a typo-squatting registration or an attempt to exploit future-dated legitimacy, though this remains unverified. This domain remains active and poses an elevated risk to users of Ethereum and related cryptocurrency platforms. Immediate mitigation steps include adding the domain to enterprise and consumer blocklists, revoking any associated SSL certificates, and notifying affected brand security teams for takedown coordination. Users who may have interacted with this site should assume compromise of wallet credentials and seed phrases, and are advised to transfer assets to new wallets using clean devices, enable multi-factor authentication where available, and monitor for unauthorized transactions. Security teams should correlate this domain with known Ethereum-related phishing campaigns for broader threat pattern analysis.