io-trezr-login-us[.]typedream[.]app

This domain, io-trezr-login-us.typedream.app, is identified as a brand impersonation phishing resource targeting Ethereum cryptocurrency users. The page mimics the official Trézor wallet interface, presenting a fraudulent login portal under the title 'Trézor®®Wallet Login The (official) wallet | Trézor®.' Analysis indicates the intent is to harvest credentials or facilitate unauthorized transactions, though no explicit drainer kit signatures were observed in initial scans. The domain does not host overt malware but relies on social engineering to deceive victims into disclosing sensitive information. Infrastructure analysis reveals the domain was registered on January 22, 2021, through Squarespace Domains II LLC and currently resolves to the IP address 172.67.206.36, associated with Cloudflare, Inc. (AS13335). Detection metrics show 17 out of 95 security vendors on VirusTotal flagging the domain as malicious. The resource appears on two security blocklists—PhishDestroy and PhishingDB—and is classified as offline at the time of this report. The SSL certificate is issued by Google Trust Services (WE1), a common feature in both legitimate and malicious domains leveraging Cloudflare infrastructure. Current status indicates the domain has been taken offline, likely in response to detection and reporting. However, the elevated risk persists due to the domain's historical use in credential harvesting campaigns. Organizations and users are advised to block the domain and IP at the network level, monitor for related infrastructure (e.g., similarly named subdomains or newly registered domains under the same registrar), and educate users on recognizing brand impersonation tactics. Continuous vigilance is recommended, as threat actors frequently rotate domains and IPs to evade detection.