learn--trezorwallets[.]typedream[.]app

This domain, learn--trezorwallets.typedream.app, is identified as a high-risk phishing resource designed to impersonate the official Trezor cryptocurrency wallet interface. Analysis indicates the site employs deceptive branding elements, including a page title labeled 'Trezor Wallet,' to mislead users into entering sensitive credentials such as recovery seeds, private keys, or wallet passwords. The objective of this campaign is financial theft, where attackers gain unauthorized access to victims' cryptocurrency holdings by harvesting authentication details through fraudulent input forms. Infrastructure analysis reveals the domain resolves to the IP address 188.114.96.3 and is hosted through Typedream, a platform allowing rapid deployment of web pages. Detection metrics confirm the site's malicious nature, with 10 out of 95 security vendors on VirusTotal flagging it as malicious. Additionally, the domain appears on three independent security blocklists and is actively blocked by cryptocurrency security tools and browser extensions. The SSL certificate, issued by Google Trust Services, does not mitigate the threat, as phishing sites frequently abuse legitimate certificates to appear credible. Technologies detected include Node.js, React, Next.js, and Google Cloud infrastructure, suggesting the use of modern web frameworks to enhance the site's deceptive appearance. Users who visited learn--trezorwallets.typedream.app should assume their credentials or recovery phrases have been compromised. Immediate action is required: revoke access to any connected wallets, transfer remaining funds to a new, secure wallet address, and monitor all linked accounts for unauthorized transactions. Enable multi-factor authentication where available and report the incident to relevant security teams or abuse contact points. Avoid reusing passwords or recovery phrases across platforms, and verify all future interactions with cryptocurrency services through official channels only. The domain has been taken offline, but similar campaigns may emerge using comparable infrastructure or branding tactics.