auth-web-ledger-live-desktop[.]typedream[.]app

This domain, auth-web-ledger-live-desktop.typedream.app, has been classified as a high‑risk brand‑impersonation site targeting Ledger. The site is actively serving content and continues to appear on two public blocklists despite prior takedown attempts by PhishDestroy and OpenPhish. Infrastructure analysis shows the domain was registered through the Typedream platform. The TLS certificate is issued by Google Trust Services under the WE1 intermediate, indicating a valid HTTPS connection. The site resolves to 188.114.97.3, an address owned by Cloudflare, Inc. in Canada. The hosting stack includes Node.js, React, Next.js, Google Cloud services such as Cloud Trace and Cloud CDN, and external assets from cdnjs. Cloudflare Browser Insights is also detected, suggesting the use of Cloudflare’s performance and security layer. Threat intelligence confirms the site masquerades as an official Ledger service, employing visual cues and URLs that mimic legitimate Ledger branding. Twelve of ninety‑five VirusTotal scanners have flagged the domain as malicious, reinforcing the suspicion of credential‑stealing or malware distribution. The nameserver query returned NS_NOT_FOUND, which may indicate deliberate obfuscation of DNS infrastructure. No further payload or phishing page details are publicly available, leaving the exact user‑interaction flow uncertain. Defenders should add the fully qualified domain name to outbound web‑filter deny lists and ensure email gateways block any messages that reference this host. Continuous DNS monitoring is advised to detect any future changes to the A record or nameserver configuration. Incident response teams should treat any credential submissions to this site as compromised and advise affected users to reset Ledger credentials immediately.