us--start-en-trazor-io-com-cdn--en[.]typedream[.]app

Analysis conducted on August 07, 2026 identifies us--start-en-trazor-io-com-cdn--en.typedream.app as an active phishing domain targeting PayPal users. The domain resolves to IP address 104.21.37.85, which is associated with Cloudflare's network infrastructure, a common hosting choice for phishing sites due to its accessibility and built-in SSL encryption. At the time of assessment, 11 of 91 security vendors on VirusTotal flagged the domain as malicious, indicating moderate but not universal detection. The domain appears on at least one security blocklist, and has been blocked by PhishDestroy, a specialized anti-phishing service. Infrastructure analysis reveals the domain is hosted on typedream.app, a platform that allows users to create and publish web pages without requiring traditional web hosting services.

This platform has been previously observed in phishing campaigns due to its ease of use and ability to quickly deploy deceptive pages. The exact content of the phishing page is not yet analysed, but the domain structure and naming convention—including terms like 'start' and 'trazor'—suggest an attempt to mimic legitimate PayPal login or verification processes. No specific phishing kit or brand impersonation beyond the domain naming has been confirmed in available data. Defenders are advised to treat this domain as high-risk for credential harvesting.

Network-level blocking of the domain and its resolved IP is recommended, particularly for organizations with users likely to be targeted by financial phishing. Security teams should monitor for connections to 104.21.37.85 and review logs for any interaction with us--start-en-trazor-io-com-cdn--en.typedream.app. Given the domain's presence on blocklists and detection by multiple security vendors, automated alerting for this indicator of compromise (IOC) is warranted. Further analysis of the page content and any associated email campaigns is recommended to determine the full scope of the threat.