faq-trzro-io-pro[.]typedream[.]app

Analysis conducted on August 07, 2026 identifies faq-trzro-io-pro.typedream.app as an active credential-theft phishing domain. The domain is hosted on the typedream.app platform, a legitimate website builder service frequently abused for phishing campaigns due to its free subdomain offerings. Infrastructure analysis reveals the domain resolves to IP address 172.67.206.36, which is part of Cloudflare's network (AS13335), a common proxy service used to conceal origin servers in phishing operations. At the time of assessment, the domain appears on one security blocklist, specifically PhishDestroy, indicating prior detection by that vendor.

VirusTotal telemetry shows that 9 of 91 security vendors flag this domain as malicious, a detection rate consistent with confirmed phishing infrastructure. No registrar details or registration date are publicly available for this subdomain, as it inherits the parent domain's registration (typedream.app, registered via Namecheap). The exact content of the phishing page remains unanalysed; however, the domain name structure—using 'faq' and a seemingly randomized string ('trzro-io-pro')—is characteristic of social-engineering lures designed to mimic legitimate support or account verification portals. Defenders are advised to treat this domain as high-risk for credential harvesting.

Network-level blocking of 172.67.206.36 and the domain itself is recommended for enterprise environments. Security teams should monitor for connections to this endpoint, particularly in sectors where account compromise could lead to data breaches or financial fraud. Given the use of Cloudflare, origin server identification may require cooperation with the hosting provider or law enforcement. No brand-specific targeting is confirmed at this stage, and the scam type is classified as generic credential theft based on available intelligence.