eng-brdige-tzoer-io[.]typedream[.]app

This domain, eng-brdige-tzoer-io.typedream.app, is actively hosting a fake login portal designed to harvest user credentials. Analysis indicates the site mimics legitimate authentication interfaces, tricking visitors into entering sensitive login details such as usernames, passwords, and potentially multi-factor authentication codes. The threat is classified as high-risk due to its active status and targeted approach, which increases the likelihood of successful credential theft and subsequent account compromise. Infrastructure analysis reveals multiple concrete indicators of malicious activity. The domain is flagged by 6 out of 95 security vendors on VirusTotal, a notable detection rate for a recently active phishing site. It resolves to the IP address 188.114.96.3, and its SSL certificate is issued by Google Trust Services, which, while legitimate, is frequently exploited by threat actors to lend credibility to fraudulent sites. The domain is registered through Typedream, a platform often abused for rapid deployment of phishing infrastructure. No specific creation date is publicly available, but the domain's active status and detection count suggest it is part of a recent campaign. Users who have visited eng-brdige-tzoer-io.typedream.app or entered credentials on the site should take immediate action to mitigate risk. First, reset passwords for any accounts accessed or entered on the site, prioritizing accounts with elevated privileges or financial access. Enable multi-factor authentication where available, using app-based or hardware tokens rather than SMS-based methods. Monitor linked accounts for unauthorized activity, including login attempts, password changes, or transactions. If financial or sensitive data was exposed, consider reporting the incident to relevant authorities and credit monitoring services. Additionally, scan local devices for malware, as phishing sites may redirect to exploit kits or distribute malicious payloads.