# PhishDestroy threat dossier — en-trezor-login-public.typedream.app ================================================================ Fetched: 2026-06-29 21:01:16 UTC Canonical: https://phishdestroy.io/domain/en-trezor-login-public.typedream.app/ ## VERDICT ---------------------------------------------------------------- ACTIVE + CLOAKED — returns HTTP 666 to scanners, real fraudulent site to victims Composite threat score: 97/100 (PhishDestroy scoring — see methodology below) Targeted brand: Trezor Cloaking: DETECTED — domain returns custom HTTP 666 to scanners while serving fraudulent content to real users (type: content_divergence) (score: 1/6) ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 0/91 security vendors flagged this domain Public blocklists: listed on 3 independent blocklists ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 188.114.97.3 (CA, Toronto) ASN: AS13335 Cloudflare, Inc. Hosting org: CloudFlare, Inc. Registrar: Typedream Nameservers: NS_NOT_FOUND Page title: Log In | Trezor® | Sign In to Your Account* - en-trezor-io-login ... HTTP response: 200 ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: pending notification queue. No abuse reports filed yet — this domain is waiting for the next cycle of our automated abuse-reporter. ## TIMELINE ---------------------------------------------------------------- First detected: 2026-06-29 16:42:21 UTC (by PhishDestroy tracker) Last verified: 2026-06-29 20:30:10 UTC Current status: ACTIVE — cloaked behind HTTP 666 to evade scanners ## EXTERNAL CORROBORATION (third-party evidence) ---------------------------------------------------------------- URLScan.io: https://urlscan.io/result/019f13d4-03a5-751f-877d-fdd5fbd551f1/ Wayback Machine: https://web.archive.org/web/*/en-trezor-login-public.typedream.app crt.sh CT logs: https://crt.sh/?q=%25.en-trezor-login-public.typedream.app Google transparency: https://transparencyreport.google.com/safe-browsing/search?url=en-trezor-login-public.typedream.app AlienVault OTX: https://otx.alienvault.com/indicator/domain/en-trezor-login-public.typedream.app URLhaus: https://urlhaus.abuse.ch/host/en-trezor-login-public.typedream.app/ ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-06-29 16:44:58 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] This domain, en-trezor-login-public.typedream.app, is flagged as an active brand impersonation threat targeting users of a cryptocurrency hardware wallet provider. The site mimics the official login interface, presenting a page titled 'Log In | Trezor® | Sign In to Your Account* - en-trezor-io-login ...', designed to deceive victims into entering credentials or recovery phrases. Analysis indicates the domain is structured to exploit trust in the targeted brand, potentially leading to unauthorized access to sensitive cryptocurrency assets if credentials are compromised. The threat is classified as high-risk due to the direct financial implications of credential theft in this sector. Infrastructure analysis reveals the domain resolves to the IP address 188.114.97.3, with no prior detections on VirusTotal (0/95 security vendors). The domain is hosted on a platform that utilizes a content delivery network, which may obscure the true origin of the malicious activity. The SSL certificate is issued by Google Trust Services, a legitimate provider, which may further lend an appearance of authenticity to the phishing page. As of the latest investigation, no blocklist entries or historical abuse reports were identified, suggesting this campaign may still be in its early stages or evading detection through low-volume targeting. The registrar and hosting provider associated with the domain have not yet taken enforcement action. Users who have visited en-trezor-login-public.typedream.app or entered credentials on the site should immediately revoke any sessions associated with the targeted service and enable multi-factor authentication if available. Credentials or recovery phrases entered on the site must be considered compromised and should not be reused. Affected individuals are advised to monitor their accounts for unauthorized transactions and report the incident to the legitimate service provider for further mitigation. Security teams should update detection rules to include this domain and its associated IP address, while also investigating potential lateral movement within networks where credentials may have been exposed. [Updates since narrative was generated:] - Public blocklists: now listed on 3 feeds ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (volunteer takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/en-trezor-login-public.typedream.app/ JSON API: https://api.destroy.tools/v1/check?domain=en-trezor-login-public.typedream.app Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: volunteer-driven open-source threat-intelligence platform. Tracked: 172,677 domains (13,179 alive under monitoring, 158,908 confirmed takedowns/dead). Site: https://phishdestroy.io