support-io-strt-trezor-cdn-sso[.]typedream[.]app

Analysis of the domain support-io-strt-trezor-cdn-sso.typedream.app confirms it as a high-risk phishing site targeting Trezor, a cryptocurrency hardware wallet brand. The domain was registered on June 16, 2026, through Typedream, a platform that enables rapid deployment of web pages, and was taken offline by July 23, 2026. Infrastructure analysis reveals the domain resolved to IP address 188.114.97.3, hosted by Cloudflare, Inc. in Canada, and utilized technologies including Node.js, React, Next.js, Google Cloud, Google Cloud CDN, and Webpack. The SSL certificate was issued by Google Trust Services (WE1), a common provider for both legitimate and malicious sites. The page title, 'Trezor.io/Start® | Trezor Suite App (Official) | Trezor®,' explicitly impersonates Trezor's official onboarding process, indicating an intent to deceive users into believing the site is legitimate.

At the time of assessment, the domain returned an HTTP 403 status, suggesting it was either restricted or disabled. Security vendor detections were notable but not universal: 14 of 91 vendors on VirusTotal flagged the domain as malicious. It appears on three security blocklists and is actively blocked by PhishDestroy, MetaMask, and SEAL. Gridinsoft assigned a trust score of 0/100, reinforcing its classification as high-risk. While the domain is now offline, defenders should treat any prior connections to this domain as indicators of compromise.

The use of Cloudflare and Google Cloud infrastructure is consistent with phishing campaigns that leverage reputable hosting providers to evade initial detection. The absence of nameservers (NS_NOT_FOUND) may indicate an attempt to obscure ownership or disrupt takedown efforts. No evidence of a specific phishing kit or payload delivery was provided; however, the combination of brand impersonation, cryptocurrency targeting, and rapid deployment infrastructure aligns with known attack patterns.