# PhishDestroy domain threat record: dow-nload-ledger-live--doc.typedream.app Content language: English Canonical HTML report: https://phishdestroy.io/domain/dow-nload-ledger-live--doc.typedream.app/ Machine-readable companion: https://phishdestroy.io/domain/dow-nload-ledger-live--doc.typedream.app/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-10-20 13:06:04 UTC - Last availability or vendor check: 2026-10-22 22:00:34 UTC - Stored record updated: 2026-10-22 22:01:45 UTC - VirusTotal detections in the stored snapshot: 9/92 - Independent public blocklist matches in the stored snapshot: 1 - Matching public blocklists: Phishunt - Google Safe Browsing stored result: no stored flag ## Stored classification - Targeted brand: ledger ## Stored infrastructure - Observed IP address: 188.114.96.1 - Last stored HTTP status: 200 - Registration date (registry RDAP, typedream.app): 2021-01-22 08:47:25 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a1591a-f20e-728f-b050-a9be3ad7eb26/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/dow-nload-ledger-live--doc.typedream.app - Certificate Transparency search: https://crt.sh/?q=%25.dow-nload-ledger-live--doc.typedream.app - Web Archive lookup: https://web.archive.org/web/*/https://dow-nload-ledger-live--doc.typedream.app/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview PhishDestroy has listed this domain as suspicious based on external security detections. The domain was first observed by PhishDestroy on 2026-10-20. No page title was recorded at the time of analysis. How the scam works The presence of multiple security detections indicates the site may be used for malicious purposes, but the available evidence does not confirm a specific technique such as credential harvesting, malware delivery, or fraud. In general, domains flagged in this way can be employed to trick users into revealing information or downloading harmful content. Evidence VirusTotal scanned the domain on 2026-10-20 and reported 9 detections from 92 engines, with alerts from alphaMountain.ai, CyRadar, DNS8, Emsisoft, Fortinet, Gridinsoft, LevelBlue and Netcraft. Google Safe Browsing checked on the same date did not flag the site. External blocklists OpenPhish and Phishunt both listed the domain, and PhishDestroy’s internal blocklist also includes it; OTX reported zero pulses as of 2026-10-20. Infrastructure The recorded DNS resolution points to IP address 188.114.96.1. No additional registration or hosting details are available beyond this recorded address. What to do Avoid entering any credentials or downloading files from the site. If you have already submitted login information, change the associated passwords and monitor the accounts for unauthorized activity. Security teams should add a block rule for the exact domain to prevent future access. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a1591a-f20e-728f-b050-a9be3ad7eb26/ VirusTotal report: https://www.virustotal.com/gui/domain/dow-nload-ledger-live--doc.typedream.app Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=dow-nload-ledger-live--doc.typedream.app Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-20 13:10:27 UTC ## Stored page captures - Primary capture: https://urlscan.io/screenshots/01a1591a-f20e-728f-b050-a9be3ad7eb26.png Captured: 2026-10-20 13:06:04 UTC - URLScan capture: https://screenshots.phishdestroy.io/01a1591a-f20e-728f-b050-a9be3ad7eb26.png Captured: 2026-10-21 03:30:32 UTC Source report: https://urlscan.io/result/01a1591a-f20e-728f-b050-a9be3ad7eb26/ - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/f9676d3e-937b-491b-95b0-acdeb544b3b6.png Captured: 2026-10-20 13:07:59 UTC Source report: https://radar.cloudflare.com/scan/f9676d3e-937b-491b-95b0-acdeb544b3b6 SHA-256: 1c16bf5f93b53b1d8cb5f15f62b7413aca02eecdab095d0f2ce6e8e04e20a997 - URLScan · 2026-10-20: https://screenshots.phishdestroy.io/us/01a156d5-f71a-73ee-be8f-472f505215c1.png Captured: 2026-10-20 01:03:54 UTC Source report: https://urlscan.io/result/01a156d5-f71a-73ee-be8f-472f505215c1/ SHA-256: d378c0c33c9b84d984a0edc3030f2827e73ec76726054534c237678a3cef0c6c - URLScan · 2026-10-20: https://screenshots.phishdestroy.io/us/01a157a3-ee2e-769e-8484-1602bcb9ae4d.png Captured: 2026-10-20 04:49:23 UTC Source report: https://urlscan.io/result/01a157a3-ee2e-769e-8484-1602bcb9ae4d/ SHA-256: d378c0c33c9b84d984a0edc3030f2827e73ec76726054534c237678a3cef0c6c - URLScan · 2026-10-20: https://screenshots.phishdestroy.io/us/01a1581b-c822-75b0-834c-bc8374ad4644.png Captured: 2026-10-20 06:59:44 UTC Source report: https://urlscan.io/result/01a1581b-c822-75b0-834c-bc8374ad4644/ SHA-256: d378c0c33c9b84d984a0edc3030f2827e73ec76726054534c237678a3cef0c6c - URLScan · 2026-10-20: https://screenshots.phishdestroy.io/us/01a1588b-ff00-743b-8e68-652e3fc1cd6b.png Captured: 2026-10-20 09:02:24 UTC Source report: https://urlscan.io/result/01a1588b-ff00-743b-8e68-652e3fc1cd6b/ SHA-256: d378c0c33c9b84d984a0edc3030f2827e73ec76726054534c237678a3cef0c6c - URLScan · 2026-10-20: https://screenshots.phishdestroy.io/us/01a15974-ea13-73e2-8c38-8ddffb45764e.png Captured: 2026-10-20 13:16:46 UTC Source report: https://urlscan.io/result/01a15974-ea13-73e2-8c38-8ddffb45764e/ SHA-256: d378c0c33c9b84d984a0edc3030f2827e73ec76726054534c237678a3cef0c6c - URLScan · 2026-10-20: https://screenshots.phishdestroy.io/us/01a159df-7c70-76ef-b29f-e2d3577048d4.png Captured: 2026-10-20 15:13:07 UTC Source report: https://urlscan.io/result/01a159df-7c70-76ef-b29f-e2d3577048d4/ SHA-256: d378c0c33c9b84d984a0edc3030f2827e73ec76726054534c237678a3cef0c6c ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-20T16:42:53Z", "uuid": "01a1591a-f20e-728f-b050-a9be3ad7eb26", "scanned_at": "2026-10-20T11:38:33Z", "final_url": "https://dow-nload-ledger-live--doc.typedream.app/", "status": 200, "ip": "172.67.206.36", "domains": [ "fonts.googleapis.com", "cdnjs.cloudflare.com", "static.cloudflareinsights.com", "i.ibb.co" ], "ips": [ "104.17.25.14", "172.253.115.95", "104.16.80.73", "207.174.26.219", "172.67.206.36" ], "asns": [ "13335", "15169", "26548" ], "countries": [ "US" ], "link_domains": [ "typedream.com" ], "doc_hash": "d2480a864625e8392a76ecd4e96c26e8b28b2c5251d4e9db6a0309a34f02db12", "script_hashes": [ "98971530458778abeb5749a04d3d3b833ae0df8e4b7375960b00b9e23af6a836", "caa66494a056f92f01d9d8ba80ec55360a6d10256fa7983c70d902ee8f29cc86", "6b551f0184e44f7d5a04c2c52f20e0bf1f8509a45b791c03a82118958b8e8bd1", "66d3385b97fac4ebc7c80d23782e81526ec33c0271a7d639148edf9f8885d4b3", "a7280da336d8bc5ee22b6067ebaa02bf025072e9d07758baf2f4602c795dc5f4", "562846f03fffa8619f79c3b2656fda2dc98019c62fd0dfc9ab3125af1a0124ab", "cecdbcd15f470ac05366f8b4d03e8b6a0da3d9d655c96080eaa3393611e4a046", "c7b5dd94081b60844217464260c70ad0ced2313ed69e05493a94dfe3fa70c13a", "ce7fe28337b6ead6b17634c8a4f2fa399cd307d5e847c9da0d0417af6c138adb", "7ab8fba833efce4a850c58ab12d4674cc1c3b41304a6f5840ba78afd7b6dd323" ], "globals": [ "webpackChunk_N_E", "__next_set_public_path__", "next", "__NEXT_DATA__", "__SSG_MANIFEST_CB", "__NEXT_P", "_N_E", "__NEXT_PRELOADREADY", "__MIDDLEWARE_MATCHERS", "__BUILD_MANIFEST", "__SSG_MANIFEST", "__cfBeacon", "quicklink" ], "tls": { "san": [ "typedream.app", "*.typedream.app" ], "cipher": "AES_128_GCM", "issuer": "WE1", "subject": "typedream.app", "protocol": "QUIC", "valid_to": "2026-12-22T15:58:29Z", "valid_from": "2026-09-23T14:58:44Z" }, "domain_age_days": 0, "apex_age_days": 0, "tls_age_days": 26, "tls_valid_days": 90, "requests": 88, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 100, "malicious": true }, "overall": { "tags": [ "phishing" ], "score": 100, "brands": [ "ledger" ], "malicious": true, "categories": [ "phishing" ] }, "urlscan": { "tags": [ "phishing" ], "score": 100, "brands": [ "Ledger" ], "malicious": true, "categories": [ "phishing" ] } }, "headers": { "server": "cloudflare", "content-type": "text/html; charset=utf-8", "x-powered-by": "Next.js" } }, "cf": { "v": 1, "fetched_at": "2026-10-20T17:55:03Z", "uuid": "f9676d3e-937b-491b-95b0-acdeb544b3b6", "scanned_at": "2026-10-20T13:07:59Z", "final_url": "https://dow-nload-ledger-live--doc.typedream.app/", "status": 200, "history": [ { "url": "https://dow-nload-ledger-live--doc.typedream.app/", "status": 200 } ], "dom_hash": "1f77a01a4b656676d8e262c6d2d7dfde1cb15d8a72f487a9041b0d6cead34574", "doc_hash": "ce09219d41b0cb757fa57137208776faa2a68175d5e3759ee547f342cc04612b", "phishing_v2": [ "phishing" ], "url_risks": [ "Phishing" ], "domain_risks": [ "Phishing", "Security threats", "CIPA Filter", "CIPA" ], "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "dow-nload-ledger-live--doc.typedream.app", "type": "A", "value": "172.67.206.36" }, { "name": "dow-nload-ledger-live--doc.typedream.app", "type": "A", "value": "104.21.37.85" } ], "dnssec_valid": false, "ip": "172.67.206.36", "verdict": { "tags": [ "phishing" ], "malicious": true, "categories": [ "phishing" ] }, "whois": { "registrar": "Squarespace Domains II LLC.", "created": "2021-01-22T08:47:25Z", "updated": "2026-01-12T09:38:06Z", "expires": "2027-01-22T08:47:25Z", "nameservers": [ "annalise.ns.cloudflare.com", "darwin.ns.cloudflare.com" ] } }, "vt": { "v": 1, "fetched_at": "2026-10-20T18:05:14Z", "analysis_at": "2026-10-20T09:02:11Z", "stats": { "timeout": 0, "harmless": 49, "malicious": 8, "suspicious": 1, "undetected": 34 }, "detections": { "DNS8": "suspicious", "CyRadar": "phishing", "Webroot": "malicious", "Emsisoft": "phishing", "Fortinet": "phishing", "Netcraft": "malicious", "LevelBlue": "phishing", "Gridinsoft": "phishing", "alphaMountain.ai": "phishing" }, "reputation": 0, "tags": [ "dga" ], "categories": { "alphaMountain.ai": "Phishing (alphaMountain.ai)" }, "registrar": "Squarespace Domains II LLC", "created": "2021-01-22T08:47:25Z", "expires": "2026-01-22T08:47:25Z", "updated": "2025-01-12T12:14:22Z", "first_seen": "2026-10-19T14:13:27Z", "dns": [ { "ttl": 300, "type": "A", "value": "172.67.206.36" }, { "ttl": 300, "type": "A", "value": "104.21.37.85" } ], "dns_at": "2026-10-20T09:02:27Z", "jarm": "27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c", "cert": { "san": [ "typedream.app", "*.typedream.app" ], "issuer": "Google Trust Services / WE1", "serial": "4978c5cda53022f50e8b10d3f8f8f4c8", "sha256": "138556077c63e0419543a8da6c8303688b66bb0ab78ce09b1973983fa45d16a4", "subject": "typedream.app", "valid_to": "2026-12-22T15:58:29Z", "valid_from": "2026-09-23T14:58:44Z" }, "whois": { "registrar": "Squarespace Domains II LLC", "registrar_iana_id": "895", "registrar_url": "domains.squarespace.com", "created": "2021-01-22T08:47:25Z", "updated": "2025-01-07T12:14:23Z", "expires": "2026-01-22T08:47:25Z", "status": [ "client", "clientDeleteProhibited", "clientTransferProhibited" ], "nameservers": [ "annalise.ns.cloudflare.com", "darwin.ns.cloudflare.com" ], "dnssec": "unsigned" } }, "webcheck": { "v": 1, "fetched_at": "2026-10-21T08:09:31Z", "mail_config": { "spf_lookups": 0 }, "caa_records": { "count": 10, "domain": "typedream.app", "issuers": [ "letsencrypt.org", "digicert.com; cansignhttpexchanges=yes", "pki.goog; cansignhttpexchanges=yes", "ssl.com", "comodoca.com" ] }, "block_lists": { "resolvers": 12, "blocked_by": [ "CloudFlare Family" ], "blocked_count": 1 }, "archives": { "last": "2026-10-20T13:08:56Z", "first": "2025-07-18T23:06:55Z", "changes": 2, "days_archived": 3, "scans_per_day": 0, "avg_page_bytes": 166239 }, "robots_txt": { "present": true }, "sitemap": { "present": true, "url_count": 1 }, "social_tags": { "ogUrl": "https://dow-nload-ledger-live--doc.typedream.page/", "title": "Ledger® Live: Download | Getting started™ Ledger®", "ogType": "website", "ogTitle": "Ledger® Live: Download | Getting started™ Ledger®", "ogSiteName": "Ledger® Live: Download | Getting started™ Ledger®", "description": "A website made with Typedream.", "twitterCard": "summary", "twitterSite": "@typedreamHQ", "ogDescription": "A website made with Typedream." }, "trackers": { "requests": 97, "trackers": [ { "name": "Cloudflare", "company": "Cloudflare", "country": "US", "category": "Hosting", "requests": 1 }, { "name": "Google Fonts", "company": "Google", "country": "US", "category": "Hosting", "requests": 69 } ] }, "mixed_content": { "third_party_scripts": 0 }, "status": { "up": true, "code": 200, "timings": { "dns": 33, "tls": 21, "wait": 868, "connect": 7, "download": 28 }, "response_ms": 957 }, "tls_connection": { "alpn": "h2", "cipher": "TLS_AES_256_GCM_SHA384", "protocol": "TLSv1.3", "versions": [ "TLSv1", "TLSv1.1", "TLSv1.2", "TLSv1.3" ], "authorized": true, "forward_secrecy": true }, "ports": { "open": [ 80, 443, 8080 ] }, "carbon": { "bytes": 2385041, "co2_grams": 0.0872, "cleaner_than": 1 }, "dns_server": { "ns": [ { "ip": "162.159.38.234", "host": "annalise.ns.cloudflare.com" }, { "ip": "172.64.33.151", "host": "darwin.ns.cloudflare.com" } ], "zone": "typedream.app" }, "location": { "ip": "188.114.96.9", "asn": "13335", "org": "Cloudflare, Inc.", "city": "Toronto", "country": "CA" }, "ssl": { "issuer": "Google Trust Services / WE1", "subject": "typedream.app" }, "dns": { "A": [ "188.114.96.9", "188.114.97.9" ] }, "dnssec": { "ds": false, "rrsig": false, "dnskey": false }, "hsts": { "message": "Site does not serve any HSTS headers." }, "http_security": { "xFrameOptions": false, "referrerPolicy": false, "xXSSProtection": false, "permissionsPolicy": false, "xContentTypeOptions": false, "contentSecurityPolicy": false, "strictTransportPolicy": false, "crossOriginOpenerPolicy": false, "crossOriginEmbedderPolicy": false, "crossOriginResourcePolicy": false }, "firewall": { "waf": "Cloudflare", "has_waf": true }, "get_ip": { "ip": "188.114.96.9", "family": 4 }, "redirects": { "chain": [ "https://dow-nload-ledger-live--doc.typedream.app" ] }, "tech_stack": { "technologies": [ "Node.js", "React", "Google Cloud", "Next.js", "cdnjs", "Quicklink", "Google Font API", "Google Cloud CDN", "Cloudflare", "Webpack", "Open Graph", "Module Federation", "HTTP/3" ] }, "social_presence": { "profiles": [ "https://x.com/typedreamHQ" ] }, "linked_pages": { "external": [ "https://typedream.com/" ], "external_count": 1 }, "headers": { "headers": { "server": "cloudflare", "content-type": "text/html; charset=utf-8", "x-powered-by": "Next.js" } } } } ```