web-eng-bridge[.]typedream[.]app

Analysis of the domain web-eng-bridge.typedream.app indicates that it is currently offline but was active as a generic phishing site targeting cryptocurrency users. The domain was registered on 21 February 2026 through Squarespace Domains II LLC and resolves to the IP address 188.114.97.3, which belongs to Cloudflare, Inc. (AS13335) and is geolocated in the United States. TLS termination is provided by a Google Trust Services certificate issued to WE1, confirming that the connection was encrypted with a legitimate certificate chain. HTTP requests to the host return a 404 status code and the page title “404: This page could not be found,” indicating that the malicious landing page has been removed or disabled.

Infrastructure inspection reveals a stack consisting of Node.js, React, Next.js, Webpack, Google Cloud services, and Cloudflare CDN, a combination frequently observed in contemporary phishing kits. VirusTotal analysis recorded 15 positive detections out of 93 scanned security vendors, and the domain appears on a single blocklist, currently listed by PhishDestroy. These signals collectively raise the risk rating to elevated. The available intelligence does not disclose the exact content of the phishing lure, the credential‑stealing mechanism, or any associated command‑and‑control infrastructure, leaving the full operational scope uncertain.

Defenders should continue to block the domain at network perimeter devices, update DNS filtering policies to include the 188.114.97.3 address, and monitor for any resurgence of the domain or related subdomains. Incident response teams should also review logs for recent connections to the IP range owned by Cloudflare, and consider adding the domain to internal threat intelligence feeds. Ongoing observation of VirusTotal and other reputation services is recommended to detect any changes in detection counts or new blocklist listings.