cloud-trez-or-hard-ware-walle-t[.]typedream[.]app

Analysis of cloud-trez-or-hard-ware-walle-t.typedream.app indicates that the site is currently offline, returning HTTP 403, and has been taken down. The domain was registered on January 22, 2021 through Squarespace Domains II LLC, and resolves to IP address 104.21.37.85, which is owned by AS13335 Cloudflare, Inc. and located in the United States. The TLS certificate is issued by Google Trust Services under the WE1 certificate authority, confirming the use of a legitimate certificate chain despite the malicious intent. Scamadviser assigns the domain a trust score of 1 out of 100, and it appears on a single security blocklist, specifically blocked by PhishDestroy.

VirusTotal data shows that 18 of 95 scanning engines have flagged the domain as malicious, reinforcing the suspicion. The page title captured from the site, "HomeTrezor® Hardware Wallet | Step-by-Step Getting Started | Trezor™," suggests a direct impersonation of the Trezor hardware wallet brand, while the intelligence tags the campaign as targeting the avalanche brand, indicating possible confusion or a broader brand‑impersonation strategy. The observed technology stack includes Node.js, React, Next.js, Google Cloud services, Cloudflare CDN, and Webpack, a combination typical of modern web applications and consistent with the infrastructure used by many phishing kits. Nameservers annalise.ns.cloudflare.com and darwin.ns.cloudflare.com confirm reliance on Cloudflare DNS.

Uncertainties remain regarding the exact phishing payload and whether any user credentials or seed phrases were harvested before the takedown; the offline status prevents further content inspection. Defenders should continue to block the domain at the network perimeter, monitor for any resurgence of the same hostnames or IP ranges, and update detection rules to incorporate the observed page title and SSL fingerprint.