sso--login--trezor--io-auth[.]typedream[.]app

This domain is an active credential harvesting site designed to impersonate the official Trezor authentication portal. Analysis indicates the page mimics the legitimate Trezor login interface, presenting users with a fraudulent form requesting wallet credentials, recovery seeds, or two-factor authentication codes. The site employs SSL encryption through Google Trust Services, creating a false sense of security while transmitting stolen data to threat actors. The domain specifically targets cryptocurrency wallet users, posing a direct risk of financial theft and unauthorized account access. Infrastructure analysis reveals the domain was registered through Typedream, a platform that enables rapid deployment of web pages without traditional hosting requirements. The site remains active as of this report, resolving to the IP address 188.114.97.3. VirusTotal detection metrics show 3 out of 95 security vendors have flagged the domain as malicious, with detections including phishing, brand impersonation, and credential theft classifications. The page title, 'Log In | Trezor® | Sign In to Your Account,' precisely matches the legitimate Trezor portal's branding, increasing the likelihood of successful deception. Users who have visited sso--login--trezor--io-auth.typedream.app should immediately revoke any entered credentials and assume compromise. Begin by disconnecting the affected device from all networks to prevent potential session hijacking. Reset all Trezor-related passwords and recovery phrases through the official Trezor.io portal using a separate, secure device. Enable multi-factor authentication on all associated accounts and monitor wallet transactions for unauthorized activity. Report the incident to Trezor's official security team and consider filing a complaint with local cybercrime authorities. Do not reuse compromised credentials on any platform.