# PhishDestroy domain threat record: start-io-trzre.typedream.app

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/start-io-trzre.typedream.app/
Machine-readable companion: https://phishdestroy.io/domain/start-io-trzre.typedream.app/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-11 08:26:54 UTC
- Last availability or vendor check: 2026-10-22 10:00:54 UTC
- Stored record updated: 2026-10-22 16:07:29 UTC
- VirusTotal detections in the stored snapshot: 17/92
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored classification

- Targeted brand: trezor

## Stored infrastructure

- Observed IP address: 188.114.97.1
- Registrar in stored WHOIS data: Squarespace Domains II LLC
- Last stored HTTP status: 301
- Registration date (registry RDAP, typedream.app): 2021-01-22 08:47:25 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a1293a-65bb-762f-9a84-cbb26f0f7b02/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/start-io-trzre.typedream.app
- Certificate Transparency search: https://crt.sh/?q=%25.start-io-trzre.typedream.app
- Web Archive lookup: https://web.archive.org/web/*/https://start-io-trzre.typedream.app/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
start-io-trzre.typedream.app is an impersonation phishing page dressed up as Trezor's official onboarding portal. It is aimed at people setting up or restoring a Trezor hardware wallet. The page sits on a subdomain of the Typedream site builder, not on any Trezor-owned domain. PhishDestroy first saw it on 2026-10-11. On 2026-10-19 the site was still alive and its content was reachable through a redirect.

How the scam works
The page is titled "Trezor.io/Start® | Starting Up Your Device | Trezor®", which copies the wording of Trezor's real setup instructions so it looks like an official step in unboxing a device. Fake setup pages of this kind usually push the visitor toward a counterfeit wallet app or straight to a form asking for the 12- or 24-word recovery seed, presented as a firmware or verification step. Anyone who types that seed into the page hands over full control of the wallet. The attacker can then sweep every asset on every account derived from it, and a hardware device offers no protection once the seed has leaked.

Evidence
On 2026-10-12, 17 of 92 VirusTotal engines flagged the address. The vendors include ESET, Kaspersky, Fortinet, Forcepoint ThreatSeeker, G-Data, Emsisoft, Gridinsoft and alphaMountain.ai. That is broad agreement among established security vendors within a day of first sighting. Spamhaus DBL lists it as DBL_ABUSED_PHISH, a category for phishing hosted on an otherwise legitimate platform. It is also on the PhishDestroy blocklist.

Infrastructure
Using a free site-builder subdomain lets an operator publish a convincing brand clone in minutes, without registering a domain that could tie back to them. Traffic is served through Cloudflare, Inc. from an address geolocated to Canada. The padlock comes from a Google Trust Services certificate. It only means the connection is encrypted and says nothing about who runs the page.

What to do
Trezor's own setup instructions never ask you to enter your recovery seed on a website. If you typed your seed here, treat the wallet as compromised: set up a new seed on a reset device and move any remaining funds to it immediately. If you downloaded software from the page, uninstall it and scan the machine. Only get Trezor Suite by typing Trezor's address yourself. Security teams should block the hostname, report it to Typedream for removal, and warn users that "trezor.io/start" lookalikes hosted on builder platforms are an active lure.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a1293a-65bb-762f-9a84-cbb26f0f7b02/
VirusTotal report: https://www.virustotal.com/gui/domain/start-io-trzre.typedream.app
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=start-io-trzre.typedream.app
Archived copy: https://web.archive.org/web/20261011083010/https://start-io-trzre.typedream.app/
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-19 09:26:53 UTC

## Stored page captures

- Primary capture: https://urlscan.io/screenshots/01a1293a-65bb-762f-9a84-cbb26f0f7b02.png
  Captured: 2026-10-11 08:26:54 UTC
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/15e73985-2937-49f7-891b-63db0c85f082.png
  Captured: 2026-10-12 10:41:58 UTC
  Source report: https://radar.cloudflare.com/scan/15e73985-2937-49f7-891b-63db0c85f082
  SHA-256: c0f74d27a8ecc0875ed07cd758fd790d9fbb3013f87c443e4ff090ecf37fcb38
- URLScan · 2026-10-11: https://screenshots.phishdestroy.io/us/01a12ab1-1961-71ed-971f-5acb5253e824.png
  Captured: 2026-10-11 11:20:22 UTC
  Source report: https://urlscan.io/result/01a12ab1-1961-71ed-971f-5acb5253e824/
  SHA-256: 163a4a8d7f7a74f40197e73ede4ef22124535396c45829fb56b4e0e8815384de
- URLScan · 2026-10-14: https://screenshots.phishdestroy.io/us/01a137de-33db-77c9-854d-1a5b2c3f2a0e.png
  Captured: 2026-10-14 00:44:38 UTC
  Source report: https://urlscan.io/result/01a137de-33db-77c9-854d-1a5b2c3f2a0e/
  SHA-256: fd041ba18fed6c3919fc77d3d3bd99e0f055805ed3fb84ca4496050952b1b8a4

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-20T17:52:23Z",
        "uuid": "01a1293a-65bb-762f-9a84-cbb26f0f7b02",
        "scanned_at": "2026-10-11T04:31:39Z",
        "final_url": "https://start-io-trzre.typedream.app/",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://start-io-trzre.typedream.app/",
                "from": "http://start-io-trzre.typedream.app/",
                "status": 307
            }
        ],
        "ip": "104.21.37.85",
        "domains": [
            "fonts.googleapis.com",
            "static.cloudflareinsights.com",
            "i.ibb.co"
        ],
        "ips": [
            "173.194.175.95",
            "104.16.80.73",
            "207.174.26.219",
            "104.21.37.85"
        ],
        "asns": [
            "15169",
            "13335",
            "26548"
        ],
        "countries": [
            "US"
        ],
        "link_domains": [
            "typedream.com"
        ],
        "doc_hash": "3c56f316be1b36f10ef4c6945ca6ec4540ef30611da26e94597a8841a69f1c19",
        "script_hashes": [
            "98971530458778abeb5749a04d3d3b833ae0df8e4b7375960b00b9e23af6a836",
            "caa66494a056f92f01d9d8ba80ec55360a6d10256fa7983c70d902ee8f29cc86",
            "6b551f0184e44f7d5a04c2c52f20e0bf1f8509a45b791c03a82118958b8e8bd1",
            "66d3385b97fac4ebc7c80d23782e81526ec33c0271a7d639148edf9f8885d4b3",
            "a7280da336d8bc5ee22b6067ebaa02bf025072e9d07758baf2f4602c795dc5f4",
            "562846f03fffa8619f79c3b2656fda2dc98019c62fd0dfc9ab3125af1a0124ab",
            "cecdbcd15f470ac05366f8b4d03e8b6a0da3d9d655c96080eaa3393611e4a046",
            "c7b5dd94081b60844217464260c70ad0ced2313ed69e05493a94dfe3fa70c13a",
            "ce7fe28337b6ead6b17634c8a4f2fa399cd307d5e847c9da0d0417af6c138adb",
            "7ab8fba833efce4a850c58ab12d4674cc1c3b41304a6f5840ba78afd7b6dd323"
        ],
        "globals": [
            "webpackChunk_N_E",
            "__next_set_public_path__",
            "next",
            "__NEXT_DATA__",
            "__SSG_MANIFEST_CB",
            "__NEXT_P",
            "_N_E",
            "__NEXT_PRELOADREADY",
            "__MIDDLEWARE_MATCHERS",
            "__BUILD_MANIFEST",
            "__SSG_MANIFEST",
            "__cfBeacon"
        ],
        "tls": {
            "san": [
                "typedream.app",
                "*.typedream.app"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "WE1",
            "subject": "typedream.app",
            "protocol": "QUIC",
            "valid_to": "2026-12-22T15:58:29Z",
            "valid_from": "2026-09-23T14:58:44Z"
        },
        "domain_age_days": 0,
        "apex_age_days": 0,
        "tls_age_days": 17,
        "tls_valid_days": 90,
        "requests": 68,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 74,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "cloudflare",
            "content-type": "text/html; charset=utf-8",
            "x-powered-by": "Next.js"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-20T18:03:15Z",
        "uuid": "15e73985-2937-49f7-891b-63db0c85f082",
        "scanned_at": "2026-10-12T10:41:58Z",
        "final_url": "https://start-io-trzre.typedream.app/",
        "status": 200,
        "history": [
            {
                "url": "https://start-io-trzre.typedream.app/",
                "status": 200
            }
        ],
        "dom_hash": "d1ded6a9f5a253de35787c24e4c8d6dc27e03515196ea120c3f310d1e73f7a06",
        "doc_hash": "8ce1639eadcc384170a9eabfab52532eca852c329788739ba8c0fc7abb362422",
        "phishing_v2": [
            "phishing"
        ],
        "url_risks": [
            "Phishing"
        ],
        "domain_risks": [
            "Phishing",
            "Security threats",
            "CIPA Filter",
            "CIPA"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "start-io-trzre.typedream.app",
                "type": "A",
                "value": "104.21.37.85"
            },
            {
                "name": "start-io-trzre.typedream.app",
                "type": "A",
                "value": "172.67.206.36"
            }
        ],
        "dnssec_valid": false,
        "ip": "104.21.37.85",
        "verdict": {
            "tags": [
                "phishing"
            ],
            "malicious": true,
            "categories": [
                "phishing"
            ]
        },
        "whois": {
            "registrar": "Squarespace Domains II LLC.",
            "created": "2021-01-22T08:47:25Z",
            "updated": "2026-01-12T09:38:06Z",
            "expires": "2027-01-22T08:47:25Z",
            "nameservers": [
                "annalise.ns.cloudflare.com",
                "darwin.ns.cloudflare.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-21T00:29:08Z",
        "analysis_at": "2026-10-11T16:29:05Z",
        "stats": {
            "timeout": 0,
            "harmless": 46,
            "malicious": 16,
            "suspicious": 2,
            "undetected": 28
        },
        "detections": {
            "DNS8": "suspicious",
            "ESET": "phishing",
            "VIPRE": "phishing",
            "G-Data": "phishing",
            "Sophos": "phishing",
            "Webroot": "malicious",
            "Emsisoft": "phishing",
            "Fortinet": "phishing",
            "Netcraft": "malicious",
            "SOCRadar": "phishing",
            "URLQuery": "suspicious",
            "Kaspersky": "phishing",
            "LevelBlue": "phishing",
            "OpenPhish": "phishing",
            "PhishFort": "phishing",
            "Gridinsoft": "phishing",
            "alphaMountain.ai": "phishing",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "tags": [
            "dga"
        ],
        "categories": {
            "alphaMountain.ai": "Phishing (alphaMountain.ai)"
        },
        "registrar": "Squarespace Domains II LLC",
        "created": "2021-01-22T08:47:25Z",
        "expires": "2026-01-22T08:47:25Z",
        "updated": "2025-01-12T12:14:22Z",
        "first_seen": "2026-10-10T19:01:24Z",
        "dns": [
            {
                "ttl": 300,
                "type": "A",
                "value": "104.21.37.85"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "172.67.206.36"
            }
        ],
        "dns_at": "2026-10-11T16:29:19Z",
        "jarm": "27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c",
        "cert": {
            "san": [
                "typedream.app",
                "*.typedream.app"
            ],
            "issuer": "Google Trust Services / WE1",
            "serial": "4978c5cda53022f50e8b10d3f8f8f4c8",
            "sha256": "138556077c63e0419543a8da6c8303688b66bb0ab78ce09b1973983fa45d16a4",
            "subject": "typedream.app",
            "valid_to": "2026-12-22T15:58:29Z",
            "valid_from": "2026-09-23T14:58:44Z"
        },
        "whois": {
            "registrar": "Squarespace Domains II LLC",
            "registrar_iana_id": "895",
            "registrar_url": "domains.squarespace.com",
            "created": "2021-01-22T08:47:25Z",
            "updated": "2025-01-07T12:14:23Z",
            "expires": "2026-01-22T08:47:25Z",
            "status": [
                "client",
                "clientDeleteProhibited",
                "clientTransferProhibited"
            ],
            "nameservers": [
                "annalise.ns.cloudflare.com",
                "darwin.ns.cloudflare.com"
            ],
            "dnssec": "unsigned"
        }
    }
}
```