public-en-trezor[.]typedream[.]app

This domain, public-en-trezor.typedream.app, is an active brand impersonation threat designed to deceive users of Trezor hardware wallets. The site mimics the official Trezor setup process, presenting itself as a legitimate initialization page for new devices. Users who follow the on-screen instructions risk exposing their recovery seed phrases, private keys, or other sensitive credentials to attackers. Such information can be used to drain cryptocurrency wallets, leading to irreversible financial losses. The page title, 'Trezor.io/Start® | Starting Up Your Device | Trézór®,' is crafted to appear authentic, leveraging official branding elements to lower user suspicion. Analysis indicates this domain is a confirmed impersonation scam with multiple technical indicators of malicious activity. The domain was registered on February 21, 2026, through Squarespace Domains II LLC, an uncommon registrar for official hardware wallet services. It resolves to the IP address 188.114.97.3, hosted on Cloudflare infrastructure, which is frequently abused by threat actors to obscure their true origin. Security vendors on VirusTotal have flagged this domain as malicious, with 9 out of 95 engines detecting it as a threat. Additionally, the domain appears on one security blocklist and is blocked by PhishDestroy, further corroborating its fraudulent nature. The SSL certificate, issued by Google Trust Services, does not mitigate the risk, as attackers commonly use valid certificates to lend false legitimacy to phishing sites. Users who have visited public-en-trezor.typedream.app or entered any sensitive information should take immediate action to secure their assets. First, disconnect the device from the internet and cease any further interaction with the site. If recovery seed phrases, private keys, or wallet credentials were entered, assume the wallet is compromised and transfer all funds to a new, secure wallet immediately. Do not reuse the old recovery seed or device. Monitor all linked accounts for unauthorized transactions and enable additional security measures, such as two-factor authentication, where available. Report the incident to the official Trezor support team and consider filing a report with relevant cybersecurity organizations or local authorities to aid in tracking the threat.