# PhishDestroy domain threat record: web-trezor--bridge.typedream.app

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/web-trezor--bridge.typedream.app/
Machine-readable companion: https://phishdestroy.io/domain/web-trezor--bridge.typedream.app/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: not observed active
- First observed by PhishDestroy: 2026-10-10 13:56:50 UTC
- Last availability or vendor check: 2026-10-21 01:17:52 UTC
- Stored record updated: 2026-10-22 14:25:10 UTC
- VirusTotal detections in the stored snapshot: 2/92
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored classification

- Targeted brand: Trezor

## Stored infrastructure

- Observed IP address: 188.114.97.1
- Registrar in stored WHOIS data: Squarespace Domains II LLC
- Last stored HTTP status: 403
- Registration date (registry RDAP, typedream.app): 2021-01-22 08:47:25 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a125e7-9445-762a-b416-3cb727936752/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/web-trezor--bridge.typedream.app
- Certificate Transparency search: https://crt.sh/?q=%25.web-trezor--bridge.typedream.app
- Web Archive lookup: https://web.archive.org/web/*/https://web-trezor--bridge.typedream.app/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
web-trezor--bridge.typedream.app was a phishing page built on a Typedream site-builder subdomain. It posed as Trezor Bridge under the title "Trézor Bridge® | Introducing the New Trézor App" and targeted owners of Trezor hardware wallets. PhishDestroy first flagged it on 2026-10-10. The site has been offline since 2026-10-11, and the hosting provider had blocked its content when we last checked on 2026-10-19.

How the scam works
The page title uses an accented "Trézor" and announces a "new app," which gives Trezor users a reason to believe they must update or reinstall their wallet software. Fake Trezor Bridge and Trezor app pages like this one usually walk the visitor through a phony setup or recovery step. That step asks for the 12- or 24-word recovery seed, or pushes a counterfeit download that captures it. Anyone holding the seed can rebuild the wallet on their own device and empty it, and the hardware wallet gives no protection once the phrase has been typed into a website.

Evidence
On VirusTotal, only 2 of 92 engines flagged the page, LevelBlue and PhishFort, as of 2026-10-10. That low count shows how little coverage a fresh builder-hosted phish gets in its first hours. Spamhaus lists the domain in its DBL as abused for phishing (DBL_ABUSED_PHISH), and it appears on the PhishDestroy blocklist.

Infrastructure
The operator did not register a domain. They used a free subdomain on Typedream with "trezor" and "bridge" placed in the hostname, which is a cheap setup that can be thrown away and rebuilt quickly. Traffic ran through Cloudflare (AS13335) at a US address. The certificate came from Google Trust Services, so visitors saw a normal HTTPS padlock, which tells you nothing about whether the page was genuine.

What to do
If you typed your recovery seed into this page, treat the wallet as compromised. Set up a new wallet with a fresh seed on your Trezor and move any remaining funds to it right away. If you downloaded anything from the page, remove it and scan the computer, then reinstall Trezor software only through the official Trezor website. Trezor never asks for your recovery phrase in a browser or app. Defenders should block this hostname and watch site-builder subdomains for wallet brand names and accented lookalike spellings such as "Trézor."

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a125e7-9445-762a-b416-3cb727936752/
VirusTotal report: https://www.virustotal.com/gui/domain/web-trezor--bridge.typedream.app
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=web-trezor--bridge.typedream.app
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-19 10:13:45 UTC

## Stored page captures

- Primary capture: https://urlscan.io/screenshots/01a125e7-9445-762a-b416-3cb727936752.png
  Captured: 2026-10-10 13:56:50 UTC
- URLScan capture: https://screenshots.phishdestroy.io/01a125e7-9445-762a-b416-3cb727936752.png
  Captured: 2026-10-11 03:30:24 UTC
  Source report: https://urlscan.io/result/01a125e7-9445-762a-b416-3cb727936752/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/4cbf94d9-79bd-406e-9e10-79bed0823293.png
  Captured: 2026-10-10 13:58:46 UTC
  Source report: https://radar.cloudflare.com/scan/4cbf94d9-79bd-406e-9e10-79bed0823293
  SHA-256: cedba732633e308560628bbab5196c8c49eed0bf3692e6077a63160a59dce3bb
- URLScan · 2026-10-10: https://screenshots.phishdestroy.io/us/01a12629-d42c-708c-a22a-e06a37ac0328.png
  Captured: 2026-10-10 14:14:06 UTC
  Source report: https://urlscan.io/result/01a12629-d42c-708c-a22a-e06a37ac0328/
  SHA-256: c0fe8d538f453541f26464fcdb4fc701e6c4ba47fb73391599b5601d2c3d3699
- URLScan · 2026-10-10: https://screenshots.phishdestroy.io/us/01a1271d-ae15-73b2-a457-7ba5e5750f81.png
  Captured: 2026-10-10 18:40:25 UTC
  Source report: https://urlscan.io/result/01a1271d-ae15-73b2-a457-7ba5e5750f81/
  SHA-256: c0fe8d538f453541f26464fcdb4fc701e6c4ba47fb73391599b5601d2c3d3699
- URLScan · 2026-10-11: https://screenshots.phishdestroy.io/us/01a12a13-132e-768e-8604-4aeaec1899b6.png
  Captured: 2026-10-11 08:27:41 UTC
  Source report: https://urlscan.io/result/01a12a13-132e-768e-8604-4aeaec1899b6/
  SHA-256: c0fe8d538f453541f26464fcdb4fc701e6c4ba47fb73391599b5601d2c3d3699
- URLScan · 2026-10-11: https://screenshots.phishdestroy.io/us/01a12a13-cc66-751c-8ec7-59d9ed51af61.png
  Captured: 2026-10-11 08:28:30 UTC
  Source report: https://urlscan.io/result/01a12a13-cc66-751c-8ec7-59d9ed51af61/
  SHA-256: c0fe8d538f453541f26464fcdb4fc701e6c4ba47fb73391599b5601d2c3d3699
- URLScan · 2026-10-12: https://screenshots.phishdestroy.io/us/01a12fb7-d660-72e8-8278-ed7d7098216f.png
  Captured: 2026-10-12 10:46:13 UTC
  Source report: https://urlscan.io/result/01a12fb7-d660-72e8-8278-ed7d7098216f/
  SHA-256: bd805e200e942bdc5cbc1413076c5b600f85a857d546daf6d2342ac7e3889e42
- URLScan · 2026-10-17: https://screenshots.phishdestroy.io/us/01a14ad1-bd36-707e-82ec-414e4803cc5a.png
  Captured: 2026-10-17 17:04:17 UTC
  Source report: https://urlscan.io/result/01a14ad1-bd36-707e-82ec-414e4803cc5a/
  SHA-256: aecd083d64f853ef76337854d4e17a5ab5f8f2f23c755680a05118ea356197a6

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-20T18:35:04Z",
        "uuid": "01a125e7-9445-762a-b416-3cb727936752",
        "scanned_at": "2026-10-10T13:01:43Z",
        "final_url": "https://web-trezor--bridge.typedream.app/",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://web-trezor--bridge.typedream.app/",
                "from": "http://web-trezor--bridge.typedream.app/",
                "status": 307
            }
        ],
        "ip": "188.114.96.3",
        "domains": [
            "fonts.googleapis.com",
            "cdnjs.cloudflare.com"
        ],
        "ips": [
            "104.17.24.14",
            "2a00:1450:4001:c0f::5f",
            "188.114.96.3"
        ],
        "asns": [
            "13335",
            "15169"
        ],
        "countries": [
            "DE"
        ],
        "link_domains": [
            "typedream.com"
        ],
        "doc_hash": "c293241a402622119899f3525be08b7c1d70e9deca14eec1a13607a5a4625972",
        "script_hashes": [
            "98971530458778abeb5749a04d3d3b833ae0df8e4b7375960b00b9e23af6a836",
            "caa66494a056f92f01d9d8ba80ec55360a6d10256fa7983c70d902ee8f29cc86",
            "6b551f0184e44f7d5a04c2c52f20e0bf1f8509a45b791c03a82118958b8e8bd1",
            "66d3385b97fac4ebc7c80d23782e81526ec33c0271a7d639148edf9f8885d4b3",
            "a7280da336d8bc5ee22b6067ebaa02bf025072e9d07758baf2f4602c795dc5f4",
            "562846f03fffa8619f79c3b2656fda2dc98019c62fd0dfc9ab3125af1a0124ab",
            "cecdbcd15f470ac05366f8b4d03e8b6a0da3d9d655c96080eaa3393611e4a046",
            "c7b5dd94081b60844217464260c70ad0ced2313ed69e05493a94dfe3fa70c13a",
            "ce7fe28337b6ead6b17634c8a4f2fa399cd307d5e847c9da0d0417af6c138adb",
            "7ab8fba833efce4a850c58ab12d4674cc1c3b41304a6f5840ba78afd7b6dd323"
        ],
        "globals": [
            "webpackChunk_N_E",
            "__next_set_public_path__",
            "next",
            "__NEXT_DATA__",
            "__SSG_MANIFEST_CB",
            "__NEXT_P",
            "_N_E",
            "__NEXT_PRELOADREADY",
            "__MIDDLEWARE_MATCHERS",
            "__BUILD_MANIFEST",
            "__SSG_MANIFEST",
            "quicklink"
        ],
        "tls": {
            "san": [
                "typedream.app",
                "*.typedream.app"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "WE1",
            "subject": "typedream.app",
            "protocol": "QUIC",
            "valid_to": "2026-12-22T15:58:29Z",
            "valid_from": "2026-09-23T14:58:44Z"
        },
        "domain_age_days": 0,
        "apex_age_days": 0,
        "tls_age_days": 16,
        "tls_valid_days": 90,
        "requests": 33,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 100,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "cloudflare",
            "content-type": "text/html; charset=utf-8",
            "x-powered-by": "Next.js"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-20T18:45:42Z",
        "uuid": "4cbf94d9-79bd-406e-9e10-79bed0823293",
        "scanned_at": "2026-10-10T13:58:46Z",
        "final_url": "https://web-trezor--bridge.typedream.app/",
        "status": 200,
        "history": [
            {
                "url": "https://web-trezor--bridge.typedream.app/",
                "status": 200
            }
        ],
        "dom_hash": "9c1373621e9c76ae72cb793a2ccfdc1f37cf8594f710aa78ab57e250d58fc02d",
        "doc_hash": "d45ca7264d1f84c967c608c794cbbff5a5763fb08a82322aa7e74129aed1a622",
        "phishing_v2": [
            "phishing"
        ],
        "url_risks": [
            "Phishing"
        ],
        "domain_risks": [
            "Phishing",
            "Security threats",
            "CIPA Filter",
            "CIPA"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "web-trezor--bridge.typedream.app",
                "type": "A",
                "value": "188.114.96.0"
            },
            {
                "name": "web-trezor--bridge.typedream.app",
                "type": "A",
                "value": "188.114.97.0"
            }
        ],
        "dnssec_valid": false,
        "ip": "188.114.96.0",
        "verdict": {
            "tags": [
                "phishing"
            ],
            "malicious": true,
            "categories": [
                "phishing"
            ]
        },
        "whois": {
            "registrar": "Squarespace Domains II LLC.",
            "created": "2021-01-22T08:47:25Z",
            "updated": "2026-01-12T09:38:06Z",
            "expires": "2027-01-22T08:47:25Z",
            "nameservers": [
                "annalise.ns.cloudflare.com",
                "darwin.ns.cloudflare.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-21T04:03:33Z",
        "analysis_at": "2026-10-11T13:02:17Z",
        "stats": {
            "timeout": 0,
            "harmless": 47,
            "malicious": 13,
            "suspicious": 1,
            "undetected": 31
        },
        "detections": {
            "G-Data": "phishing",
            "Sophos": "phishing",
            "Emsisoft": "phishing",
            "Fortinet": "phishing",
            "Netcraft": "malicious",
            "SOCRadar": "suspicious",
            "URLQuery": "malicious",
            "Kaspersky": "phishing",
            "LevelBlue": "phishing",
            "OpenPhish": "phishing",
            "PhishFort": "phishing",
            "Gridinsoft": "phishing",
            "alphaMountain.ai": "phishing",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "tags": [
            "dga"
        ],
        "registrar": "Squarespace Domains II LLC",
        "created": "2021-01-22T08:47:25Z",
        "expires": "2026-01-22T08:47:25Z",
        "updated": "2025-01-12T12:14:22Z",
        "first_seen": "2026-10-10T03:54:54Z",
        "dns": [
            {
                "ttl": 300,
                "type": "A",
                "value": "172.67.206.36"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "104.21.37.85"
            }
        ],
        "dns_at": "2026-10-11T13:02:31Z",
        "jarm": "27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c",
        "cert": {
            "san": [
                "typedream.app",
                "*.typedream.app"
            ],
            "issuer": "Google Trust Services / WE1",
            "serial": "4978c5cda53022f50e8b10d3f8f8f4c8",
            "sha256": "138556077c63e0419543a8da6c8303688b66bb0ab78ce09b1973983fa45d16a4",
            "subject": "typedream.app",
            "valid_to": "2026-12-22T15:58:29Z",
            "valid_from": "2026-09-23T14:58:44Z"
        },
        "whois": {
            "registrar": "Squarespace Domains II LLC",
            "registrar_iana_id": "895",
            "registrar_url": "domains.squarespace.com",
            "created": "2021-01-22T08:47:25Z",
            "updated": "2025-01-07T12:14:23Z",
            "expires": "2026-01-22T08:47:25Z",
            "status": [
                "client",
                "clientDeleteProhibited",
                "clientTransferProhibited"
            ],
            "nameservers": [
                "annalise.ns.cloudflare.com",
                "darwin.ns.cloudflare.com"
            ],
            "dnssec": "unsigned"
        }
    }
}
```