web-faq-trezor-eng-public[.]typedream[.]app

This domain is flagged for elevated-risk brand impersonation targeting Trezor users through credential harvesting. Analysis indicates the site presents a fraudulent login interface labeled 'Trezor @Login | Sing In*' to deceive victims into submitting sensitive authentication details, including wallet credentials and recovery phrases. Infrastructure analysis reveals the domain web-faq-trezor-eng-public.typedream.app resolves to IP address 188.114.97.3 and uses an SSL certificate issued by Google Trust Services. VirusTotal detection shows 2 out of 95 security vendors have flagged this domain as malicious. The page title explicitly mimics Trezor's official branding, and the domain structure suggests an attempt to appear as a legitimate FAQ or support portal. No creation date or registrar details were provided in the initial intelligence, limiting temporal attribution, but the low detection rate indicates either recent deployment or effective evasion techniques. Mitigation requires immediate blocking of the domain and its resolving IP (188.114.97.3) at network and endpoint levels. Users should verify domain authenticity by cross-referencing official Trezor communication channels and avoid entering credentials on any page not hosted on trezor.io or its verified subdomains. Organizations should deploy email and web filtering rules to detect similar impersonation patterns, such as domains containing 'trezor' combined with generic hosting providers (e.g., typedream.app). Incident response teams should monitor for credential reuse attempts following exposure to this domain and reset any compromised authentication data.