faq-trzor-en-us-trezor[.]typedream[.]app

On July 24, 2026, the domain faq-trzor-en-us-trezor.typedream.app was identified as a high-risk brand-impersonation infrastructure targeting the cryptocurrency hardware-wallet provider Trezor. The site’s HTTP response returned a 403 status code, and DNS queries revealed no nameserver information (NS_NOT_FOUND), indicating that the domain’s authoritative records have been removed or are otherwise unavailable. The domain resolves to IP address 188.114.96.3, which belongs to AS13335 Cloudflare, Inc., located in the United States; the SSL certificate presented is issued by Google Trust Services under the WE1 identifier, a common certificate for services hosted behind Cloudflare.

The page title observed during the brief fetch was “Trèzōr Hardware⋇ Wallet | Getting Started | Trèzōr ® (official)”, directly referencing the Trezor brand and confirming the impersonation intent. The domain was registered through the Typedream website-builder platform, a service often abused for rapid deployment of malicious pages. Independent security vendors have flagged the site: VirusTotal recorded detections by 10 of 91 scanners, and the domain appears on three public blocklists, specifically PhishDestroy, MetaMask, and SEAL, all of which classified it as a brand-impersonation threat.

The site has since been taken offline, as indicated by its current status, but the residual infrastructure – the domain registration, DNS resolution to a Cloudflare edge, and the TLS certificate – remains observable and may be reused. Defenders should continue to block the domain at network perimeter and DNS layers, monitor for re-registration attempts, and add the associated IP address to threat-intel feeds. Additional analysis of the underlying Typedream account could reveal further malicious sites, and threat-intel sharing platforms should be updated with the observed indicators of compromise.