new-portal-suite-treo[.]typedream[.]app

This domain, new-portal-suite-treo.typedream.app, is currently engaged in credential harvesting phishing operations targeting users through deceptive portal-themed landing pages. The infrastructure mimics legitimate authentication portals to trick victims into submitting sensitive login credentials, which are then exfiltrated to attacker-controlled endpoints. Analysis indicates the campaign is designed to impersonate corporate or cloud service sign-in pages, increasing the likelihood of successful compromise for users unaware of the fraudulent nature of the site. Infrastructure analysis reveals the domain resolves to the IP address 188.114.97.3 and is hosted under a subdomain of typedream.app, registered through the Typedream platform. The domain’s SSL certificate is issued by Google Trust Services, providing a false sense of legitimacy to potential victims. As of the latest assessment, the domain is flagged by 8 out of 95 security vendors on VirusTotal, with no prior historical records indicating prior malicious activity. No additional blocklist entries were identified beyond the VirusTotal detections, though the domain remains active and unmitigated. Users who have visited new-portal-suite-treo.typedream.app or entered credentials on the site should immediately revoke any submitted passwords and enable multi-factor authentication on associated accounts. Network administrators are advised to block the domain and its resolving IP address (188.114.97.3) at the perimeter to prevent further access. Victims should monitor accounts for unauthorized activity and consider reporting the incident to relevant security response teams for further mitigation and analysis.