tre-zoor-trezurr-login-docs[.]typedream[.]app

This domain, tre-zoor-trezurr-login-docs.typedream.app, is flagged as a high-risk brand impersonation threat targeting Trezor, a cryptocurrency hardware wallet provider. Analysis indicates the domain mimics Trezor’s official login portal, presenting a page titled 'Trezor @Login | The official wallet* | Secure*', designed to harvest user credentials or facilitate unauthorized access to cryptocurrency assets. No explicit drainer kit signatures were detected, but the domain’s structure and content align with credential theft campaigns targeting cryptocurrency users.

Infrastructure analysis reveals the domain resolves to IP address 188.114.96.3 and was registered through Typedream, a platform enabling rapid deployment of web pages. The domain is hosted on infrastructure utilizing Node.js, React, Next.js, and Google Cloud services, with Cloudflare providing additional CDN and security layers. VirusTotal detection indicates 17 out of 95 security vendors flag the domain as malicious, while it appears on three distinct security blocklists. The SSL certificate is issued by Google Trust Services, a common feature in both legitimate and malicious domains. No creation date was provided, and Google Safe Browsing (GSB) status remains unconfirmed at the time of analysis.

The domain remains active and is currently blocked by multiple security mechanisms, including browser-based wallet protections and third-party threat intelligence feeds. Despite these mitigations, the risk of credential theft persists due to the domain’s sophisticated impersonation of Trezor’s branding and login interface. Users are advised to verify domain authenticity via official channels, avoid interacting with untrusted login portals, and employ hardware-based authentication methods for cryptocurrency transactions. Continuous monitoring of related infrastructure is recommended to detect further malicious activity.