app-up-hold-com-auth[.]typedream[.]app

This domain, app-up-hold-com-auth.typedream.app, is identified as a high-risk phishing site designed to harvest user credentials through fake login portals. Analysis indicates no direct association with a specific brand or drainer kit, but the infrastructure aligns with generic credential theft campaigns. The 404 error page currently displayed suggests the malicious content has been removed or relocated, though prior activity confirms its use in phishing operations. Infrastructure analysis reveals the domain was registered through Squarespace Domains II LLC on February 21, 2026, an unusually future-dated entry that may indicate an attempt to evade detection or a data entry anomaly. It resolves to IP 172.67.206.36, hosted on AS13335 (Cloudflare, Inc.), a common tactic to obscure origin servers. Google Safe Browsing flags the domain as phishing, and it appears on 3 security blocklists. VirusTotal reports 17 out of 95 security vendors detecting the domain as malicious, with SSL certification issued by Google Trust Services (WE1), a legitimate provider often abused in phishing campaigns. The domain is currently offline, likely due to enforcement actions by hosting providers or registrars following reports from security entities such as PhishDestroy, MetaMask, and SEAL. Despite its inactive status, residual risk remains for users who may have interacted with the domain prior to takedown. Organizations are advised to block the domain and IP at the perimeter, review logs for connections to 172.67.206.36, and alert affected users to reset credentials if compromised. Continuous monitoring for related domains using the same registrar or hosting infrastructure is recommended due to the likelihood of attacker pivoting.