# PhishDestroy threat dossier — secure-faq-trezor-eng-public.typedream.app ================================================================ Fetched: 2026-06-30 08:31:46 UTC Canonical: https://phishdestroy.io/domain/secure-faq-trezor-eng-public.typedream.app/ ## VERDICT ---------------------------------------------------------------- ACTIVE + CLOAKED — returns HTTP 666 to scanners, real fraudulent site to victims Composite threat score: 100/100 (PhishDestroy scoring — see methodology below) Targeted brand: Trezor Cloaking: DETECTED — domain returns custom HTTP 666 to scanners while serving fraudulent content to real users (type: content_divergence) (score: 3/6) ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 14/91 security vendors flagged this domain Flagging vendors: ChainPatrol, alphaMountain.ai, BitDefender, ESET, Emsisoft, Fortinet, G-Data, Gridinsoft, Kaspersky, LevelBlue, Netcraft, OpenPhish, PhishFort, Sophos Public blocklists: listed on 3 independent blocklists ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 104.21.37.85 (US, San Francisco) ASN: ASAS13335 CLOUDFLARENET - Cloudflare, Inc., US Hosting org: AS13335 Cloudflare, Inc. Registrar: Typedream Nameservers: NS_NOT_FOUND Page title: Trezor Login – Secure | Access to Your Crypto HTTP response: 200 ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: pending notification queue. No abuse reports filed yet — this domain is waiting for the next cycle of our automated abuse-reporter. ## TIMELINE ---------------------------------------------------------------- First detected: 2026-06-29 00:26:13 UTC (by PhishDestroy tracker) Last verified: 2026-06-30 08:20:34 UTC Current status: ACTIVE — cloaked behind HTTP 666 to evade scanners ## EXTERNAL CORROBORATION (third-party evidence) ---------------------------------------------------------------- URLScan.io: https://urlscan.io/result/019f1056-302c-72d9-956f-36fb2e173097/ Wayback Machine: https://web.archive.org/web/*/secure-faq-trezor-eng-public.typedream.app crt.sh CT logs: https://crt.sh/?q=%25.secure-faq-trezor-eng-public.typedream.app Google transparency: https://transparencyreport.google.com/safe-browsing/search?url=secure-faq-trezor-eng-public.typedream.app AlienVault OTX: https://otx.alienvault.com/indicator/domain/secure-faq-trezor-eng-public.typedream.app URLhaus: https://urlhaus.abuse.ch/host/secure-faq-trezor-eng-public.typedream.app/ ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-06-29 00:34:39 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] This domain is an active phishing site designed to impersonate Trezor, a hardware cryptocurrency wallet provider, with the intent to harvest user credentials and sensitive wallet recovery phrases. The page presents a fraudulent login interface titled 'Trezor Login – Secure | Access to Your Crypto,' mimicking the legitimate Trezor authentication portal. Analysis indicates the site is engineered to deceive users into entering their private keys or seed phrases, which would grant attackers full control over the victims' cryptocurrency assets. The threat is classified as brand impersonation with an elevated risk level due to the direct financial consequences of credential compromise. Infrastructure analysis reveals the domain is hosted on the Typedream platform and resolves to the IP address 188.114.97.3. Detection metrics from VirusTotal indicate that 4 out of 95 security vendors have flagged the domain as malicious, a relatively low but non-zero detection rate that suggests the campaign may still be evading broader scrutiny. The SSL certificate is issued by Google Trust Services, which, while not inherently indicative of malicious activity, is commonly exploited by threat actors to lend an appearance of legitimacy to phishing sites. No historical registration data is available, limiting further attribution; however, the use of a subdomain under typedream.app aligns with tactics observed in other low-effort phishing campaigns. Users who have visited secure-faq-trezor-eng-public.typedream.app or entered credentials on the site should immediately revoke access to any associated cryptocurrency wallets and transfer remaining assets to a new, secure wallet. It is critical to avoid reusing passwords or seed phrases across platforms, as compromised credentials may be leveraged in subsequent attacks. Affected individuals should monitor their wallet activity for unauthorized transactions and report the incident to relevant security teams or blockchain analytics providers. Browser-based security tools or network-level blocking of the domain and its resolving IP (188.114.97.3) is recommended to prevent further exposure. ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (volunteer takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/secure-faq-trezor-eng-public.typedream.app/ JSON API: https://api.destroy.tools/v1/check?domain=secure-faq-trezor-eng-public.typedream.app Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: volunteer-driven open-source threat-intelligence platform. Tracked: 172,677 domains (13,093 alive under monitoring, 158,994 confirmed takedowns/dead). Site: https://phishdestroy.io