secure-faq-trezor-eng-public[.]typedream[.]app

This domain is an active phishing site designed to impersonate Trezor, a hardware cryptocurrency wallet provider, with the intent to harvest user credentials and sensitive wallet recovery phrases. The page presents a fraudulent login interface titled 'Trezor Login – Secure | Access to Your Crypto,' mimicking the legitimate Trezor authentication portal. Analysis indicates the site is engineered to deceive users into entering their private keys or seed phrases, which would grant attackers full control over the victims' cryptocurrency assets. The threat is classified as brand impersonation with an elevated risk level due to the direct financial consequences of credential compromise. Infrastructure analysis reveals the domain is hosted on the Typedream platform and resolves to the IP address 188.114.97.3. Detection metrics from VirusTotal indicate that 4 out of 95 security vendors have flagged the domain as malicious, a relatively low but non-zero detection rate that suggests the campaign may still be evading broader scrutiny. The SSL certificate is issued by Google Trust Services, which, while not inherently indicative of malicious activity, is commonly exploited by threat actors to lend an appearance of legitimacy to phishing sites. No historical registration data is available, limiting further attribution; however, the use of a subdomain under typedream.app aligns with tactics observed in other low-effort phishing campaigns. Users who have visited secure-faq-trezor-eng-public.typedream.app or entered credentials on the site should immediately revoke access to any associated cryptocurrency wallets and transfer remaining assets to a new, secure wallet. It is critical to avoid reusing passwords or seed phrases across platforms, as compromised credentials may be leveraged in subsequent attacks. Affected individuals should monitor their wallet activity for unauthorized transactions and report the incident to relevant security teams or blockchain analytics providers. Browser-based security tools or network-level blocking of the domain and its resolving IP (188.114.97.3) is recommended to prevent further exposure.