access-docs-us-trezor-io-start[.]typedream[.]app

The domain access-docs-us-trezor-io-start.typedream.app was observed on August 07, 2026 as an active high‑risk crypto‑drainer infrastructure. Registration metadata indicates the domain was created through the Typedream platform, a website‑builder service that supplies DNS hosting for user‑generated subdomains. The domain resolves to the IPv4 address 172.67.206.36, an address owned by the Cloudflare network, which is frequently leveraged by threat actors to hide the true location of their command‑and‑control servers.

Multiple open‑source phishing feeds have flagged the domain: PhishDestroy, OpenPhish and Phishunt have each added it to their blocklists, and it appears on three additional security blocklists. VirusTotal analysis shows that 17 of 91 scanned scanners label the domain as malicious, reinforcing the suspicion of malicious intent. The classification as a crypto drainer aligns with the observed targeting of cryptocurrency wallets, although specific lures or payloads have not been disclosed in the available intelligence.

Defenders should immediately block DNS resolution for the domain and any associated IP address, enforce outbound traffic filtering to Cloudflare edge nodes that resolve to this address, and monitor for anomalous connections from internal hosts to the host. Continuous re‑evaluation of the domain’s status is advised, as the underlying infrastructure may be repurposed for other phishing campaigns.