# PhishDestroy domain threat record: safe-ldgreliveapp.typedream.app

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/safe-ldgreliveapp.typedream.app/
Machine-readable companion: https://phishdestroy.io/domain/safe-ldgreliveapp.typedream.app/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-19 01:22:39 UTC
- Last availability or vendor check: 2026-10-22 10:00:26 UTC
- Stored record updated: 2026-10-22 16:07:29 UTC
- VirusTotal detections in the stored snapshot: 18/92
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored classification

- Targeted brand: ledger

## Stored infrastructure

- Observed IP address: 188.114.96.1
- Last stored HTTP status: 200
- Registration date (registry RDAP, typedream.app): 2021-01-22 08:47:25 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a14d56-9aa9-762c-8abc-17a2790d4310/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/safe-ldgreliveapp.typedream.app
- Certificate Transparency search: https://crt.sh/?q=%25.safe-ldgreliveapp.typedream.app
- Web Archive lookup: https://web.archive.org/web/*/https://safe-ldgreliveapp.typedream.app/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
This site is an impersonation phishing page posing as the official Ledger Live Crypto Wallet App. It targets Ledger users by replicating the legitimate page title and branding. PhishDestroy first identified the domain on 2026-10-19. The site’s status shows no accessible content, preventing further analysis.

How the scam works
Visitors see a fake Ledger Live page titled 'Ledger Live Crypto Wallet App | Getting started,' designed to trick them into entering recovery phrases or private keys. Once submitted, attackers gain control of the victim’s Ledger wallet and can drain cryptocurrency funds. The page mimics the legitimate Ledger interface to deceive users into believing it is authentic.

Evidence
VirusTotal detected the domain with 18 detections from 92 engines, including AlphaMountain.ai, BitDefender, CyRadar, ESET, Emsisoft, Forcepoint ThreatSeeker, Fortinet, and G-Data. urlscan.io assigned a malicious verdict and flagged the Ledger brand. The domain is listed on PhishDestroy’s blocklist and flagged by Spamhaus DBL_PHISH.

Infrastructure
The domain resolves to an IP address (188.114.96.1) on Cloudflare’s network (AS13335) in the United States. The TLS certificate was issued by WE1.

What to do
If you visited this site or entered any credentials, immediately transfer remaining funds to a new wallet. Reset passwords for all related accounts and enable two-factor authentication. Report the incident to Ledger support and consider filing a complaint with local law enforcement. Defenders should block the domain and IP, and update security tool blocklists to prevent further exposure.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a14d56-9aa9-762c-8abc-17a2790d4310/
VirusTotal report: https://www.virustotal.com/gui/domain/safe-ldgreliveapp.typedream.app
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=safe-ldgreliveapp.typedream.app
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-19 06:49:24 UTC

## Stored page captures

- Primary capture: https://urlscan.io/screenshots/01a14d56-9aa9-762c-8abc-17a2790d4310.png
  Captured: 2026-10-19 01:22:39 UTC
- URLScan capture: https://screenshots.phishdestroy.io/01a14d56-9aa9-762c-8abc-17a2790d4310.png
  Captured: 2026-10-19 03:30:11 UTC
  Source report: https://urlscan.io/result/01a14d56-9aa9-762c-8abc-17a2790d4310/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/c5e7f81b-35b0-4722-976e-2a0b2e482068.png
  Captured: 2026-10-19 01:24:41 UTC
  Source report: https://radar.cloudflare.com/scan/c5e7f81b-35b0-4722-976e-2a0b2e482068
  SHA-256: afe7bb07c7a54a7209c9e46b7805e7971bf49b310a8390d4b1de2cd81b87eb5d
- URLScan · 2026-10-18: https://screenshots.phishdestroy.io/us/01a14c8a-86fe-750c-81bc-c4c62d4c8fe7.png
  Captured: 2026-10-18 01:05:18 UTC
  Source report: https://urlscan.io/result/01a14c8a-86fe-750c-81bc-c4c62d4c8fe7/
  SHA-256: 6363a0e446b44005c2a535f051b8668bb887c05afa852f28ef62e8c131fa211f
- URLScan · 2026-10-19: https://screenshots.phishdestroy.io/us/01a151c4-1247-7719-a823-a5937052ccde.png
  Captured: 2026-10-19 01:26:13 UTC
  Source report: https://urlscan.io/result/01a151c4-1247-7719-a823-a5937052ccde/
  SHA-256: 6363a0e446b44005c2a535f051b8668bb887c05afa852f28ef62e8c131fa211f

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-20T16:45:00Z",
        "uuid": "01a14d56-9aa9-762c-8abc-17a2790d4310",
        "scanned_at": "2026-10-18T04:48:38Z",
        "final_url": "https://safe-ldgreliveapp.typedream.app/",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://safe-ldgreliveapp.typedream.app/",
                "from": "http://safe-ldgreliveapp.typedream.app/",
                "status": 307
            }
        ],
        "ip": "104.21.37.85",
        "domains": [
            "fonts.googleapis.com",
            "cdnjs.cloudflare.com",
            "static.cloudflareinsights.com",
            "i.ibb.co",
            "image.typedream.com"
        ],
        "ips": [
            "104.17.24.14",
            "172.217.222.95",
            "104.16.80.73",
            "207.174.26.219",
            "104.21.37.85"
        ],
        "asns": [
            "13335",
            "15169",
            "26548"
        ],
        "countries": [
            "US"
        ],
        "link_domains": [
            "www.ledger.com",
            "typedream.com"
        ],
        "doc_hash": "086f7dace3ff299a0f1f1bdc8c8c9a0f5963049fef2f5b486e4c23b29915e9b5",
        "script_hashes": [
            "98971530458778abeb5749a04d3d3b833ae0df8e4b7375960b00b9e23af6a836",
            "caa66494a056f92f01d9d8ba80ec55360a6d10256fa7983c70d902ee8f29cc86",
            "6b551f0184e44f7d5a04c2c52f20e0bf1f8509a45b791c03a82118958b8e8bd1",
            "66d3385b97fac4ebc7c80d23782e81526ec33c0271a7d639148edf9f8885d4b3",
            "a7280da336d8bc5ee22b6067ebaa02bf025072e9d07758baf2f4602c795dc5f4",
            "562846f03fffa8619f79c3b2656fda2dc98019c62fd0dfc9ab3125af1a0124ab",
            "cecdbcd15f470ac05366f8b4d03e8b6a0da3d9d655c96080eaa3393611e4a046",
            "c7b5dd94081b60844217464260c70ad0ced2313ed69e05493a94dfe3fa70c13a",
            "ce7fe28337b6ead6b17634c8a4f2fa399cd307d5e847c9da0d0417af6c138adb",
            "7ab8fba833efce4a850c58ab12d4674cc1c3b41304a6f5840ba78afd7b6dd323"
        ],
        "globals": [
            "webpackChunk_N_E",
            "__next_set_public_path__",
            "next",
            "__NEXT_DATA__",
            "__SSG_MANIFEST_CB",
            "__NEXT_P",
            "_N_E",
            "__NEXT_PRELOADREADY",
            "__MIDDLEWARE_MATCHERS",
            "__BUILD_MANIFEST",
            "__SSG_MANIFEST",
            "__cfBeacon",
            "quicklink"
        ],
        "tls": {
            "san": [
                "typedream.app",
                "*.typedream.app"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "WE1",
            "subject": "typedream.app",
            "protocol": "TLS 1.3",
            "valid_to": "2026-12-22T15:58:29Z",
            "valid_from": "2026-09-23T14:58:44Z"
        },
        "domain_age_days": 0,
        "apex_age_days": 0,
        "tls_age_days": 24,
        "tls_valid_days": 90,
        "requests": 58,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 100,
                "malicious": true
            },
            "overall": {
                "tags": [
                    "phishing"
                ],
                "score": 100,
                "brands": [
                    "ledger"
                ],
                "malicious": true,
                "categories": [
                    "phishing"
                ]
            },
            "urlscan": {
                "tags": [
                    "phishing"
                ],
                "score": 100,
                "brands": [
                    "Ledger"
                ],
                "malicious": true,
                "categories": [
                    "phishing"
                ]
            }
        },
        "headers": {
            "server": "cloudflare",
            "content-type": "text/html; charset=utf-8",
            "x-powered-by": "Next.js"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-20T17:56:06Z",
        "uuid": "c5e7f81b-35b0-4722-976e-2a0b2e482068",
        "scanned_at": "2026-10-19T01:24:41Z",
        "final_url": "https://safe-ldgreliveapp.typedream.app/",
        "status": 200,
        "history": [
            {
                "url": "https://safe-ldgreliveapp.typedream.app/",
                "status": 200
            }
        ],
        "dom_hash": "5445bcbadc92f3bdf293cef447429d2a505aaa48be219cfd187fc39da95652f8",
        "doc_hash": "aad9d06417d2c15e865039ee1fc7f59858e0a6da4069f020a01fdb238363b24a",
        "phishing_v2": [
            "phishing"
        ],
        "url_risks": [
            "Phishing"
        ],
        "domain_risks": [
            "Phishing",
            "Security threats",
            "CIPA Filter",
            "CIPA"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "safe-ldgreliveapp.typedream.app",
                "type": "A",
                "value": "104.21.37.85"
            },
            {
                "name": "safe-ldgreliveapp.typedream.app",
                "type": "A",
                "value": "172.67.206.36"
            }
        ],
        "dnssec_valid": false,
        "ip": "104.21.37.85",
        "verdict": {
            "tags": [
                "phishing"
            ],
            "malicious": true,
            "categories": [
                "phishing"
            ]
        },
        "whois": {
            "registrar": "Squarespace Domains II LLC.",
            "created": "2021-01-22T08:47:25Z",
            "updated": "2026-01-12T09:38:06Z",
            "expires": "2027-01-22T08:47:25Z",
            "nameservers": [
                "annalise.ns.cloudflare.com",
                "darwin.ns.cloudflare.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-20T18:07:22Z",
        "analysis_at": "2026-10-18T11:43:37Z",
        "stats": {
            "timeout": 0,
            "harmless": 44,
            "malicious": 17,
            "suspicious": 1,
            "undetected": 30
        },
        "detections": {
            "ESET": "phishing",
            "VIPRE": "phishing",
            "G-Data": "phishing",
            "Lionic": "phishing",
            "Sophos": "phishing",
            "CyRadar": "phishing",
            "Webroot": "malicious",
            "Emsisoft": "phishing",
            "Fortinet": "phishing",
            "Netcraft": "malicious",
            "SOCRadar": "suspicious",
            "URLQuery": "malicious",
            "Kaspersky": "phishing",
            "OpenPhish": "phishing",
            "Gridinsoft": "phishing",
            "BitDefender": "phishing",
            "alphaMountain.ai": "phishing",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "tags": [
            "dga"
        ],
        "categories": {
            "alphaMountain.ai": "Phishing (alphaMountain.ai)"
        },
        "registrar": "Squarespace Domains II LLC",
        "created": "2021-01-22T08:47:25Z",
        "expires": "2026-01-22T08:47:25Z",
        "updated": "2025-01-12T12:14:22Z",
        "first_seen": "2026-10-17T11:53:44Z",
        "dns": [
            {
                "ttl": 300,
                "type": "A",
                "value": "104.21.37.85"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "172.67.206.36"
            }
        ],
        "dns_at": "2026-10-18T11:43:50Z",
        "jarm": "27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c",
        "cert": {
            "san": [
                "typedream.app",
                "*.typedream.app"
            ],
            "issuer": "Google Trust Services / WE1",
            "serial": "4978c5cda53022f50e8b10d3f8f8f4c8",
            "sha256": "138556077c63e0419543a8da6c8303688b66bb0ab78ce09b1973983fa45d16a4",
            "subject": "typedream.app",
            "valid_to": "2026-12-22T15:58:29Z",
            "valid_from": "2026-09-23T14:58:44Z"
        },
        "whois": {
            "registrar": "Squarespace Domains II LLC",
            "registrar_iana_id": "895",
            "registrar_url": "domains.squarespace.com",
            "created": "2021-01-22T08:47:25Z",
            "updated": "2025-01-07T12:14:23Z",
            "expires": "2026-01-22T08:47:25Z",
            "status": [
                "client",
                "clientDeleteProhibited",
                "clientTransferProhibited"
            ],
            "nameservers": [
                "annalise.ns.cloudflare.com",
                "darwin.ns.cloudflare.com"
            ],
            "dnssec": "unsigned"
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-22T03:44:16Z",
        "mail_config": {
            "spf_lookups": 0
        },
        "caa_records": {
            "count": 10,
            "domain": "typedream.app",
            "issuers": [
                "pki.goog; cansignhttpexchanges=yes",
                "ssl.com",
                "comodoca.com",
                "digicert.com; cansignhttpexchanges=yes",
                "letsencrypt.org"
            ]
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_by": [
                "CloudFlare Family"
            ],
            "blocked_count": 1
        },
        "robots_txt": {
            "present": true
        },
        "sitemap": {
            "present": true,
            "url_count": 1
        },
        "social_tags": {
            "ogUrl": "https://safe-ldgreliveapp.typedream.page/",
            "title": "Ledgêr® Live App | Getting™ started with Ledger®y",
            "ogType": "website",
            "ogTitle": "Ledgêr® Live App | Getting™ started with Ledger®y",
            "keywords": "Ledger live, ledger.com/start, Ledger live app, ledger live wallet, Ledger, Ledger live login, www.ledger.com/start",
            "ogSiteName": "ledger live app",
            "description": "A website made with Typedream.",
            "twitterCard": "summary",
            "twitterSite": "@typedreamHQ",
            "ogDescription": "A website made with Typedream."
        },
        "trackers": {
            "requests": 52,
            "trackers": [
                {
                    "name": "Cloudflare",
                    "company": "Cloudflare",
                    "country": "US",
                    "category": "Hosting",
                    "requests": 1
                },
                {
                    "name": "Google Fonts",
                    "company": "Google",
                    "country": "US",
                    "category": "Hosting",
                    "requests": 21
                }
            ]
        },
        "mixed_content": {
            "third_party_scripts": 0
        },
        "status": {
            "up": true,
            "code": 200,
            "timings": {
                "dns": 60,
                "tls": 10,
                "wait": 701,
                "connect": 7,
                "download": 30
            },
            "response_ms": 808
        },
        "tls_connection": {
            "alpn": "h2",
            "cipher": "TLS_AES_256_GCM_SHA384",
            "protocol": "TLSv1.3",
            "versions": [
                "TLSv1",
                "TLSv1.1",
                "TLSv1.2",
                "TLSv1.3"
            ],
            "authorized": true,
            "forward_secrecy": true
        },
        "ports": {
            "open": [
                80,
                443,
                8080
            ]
        },
        "carbon": {
            "bytes": 1735408,
            "co2_grams": 0.0635,
            "cleaner_than": 1
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "172.64.34.234",
                    "host": "annalise.ns.cloudflare.com"
                },
                {
                    "ip": "108.162.193.151",
                    "host": "darwin.ns.cloudflare.com"
                }
            ],
            "zone": "typedream.app"
        },
        "location": {
            "ip": "188.114.96.9",
            "asn": "13335",
            "org": "Cloudflare, Inc.",
            "city": "Francisco",
            "country": "US"
        },
        "ssl": {
            "issuer": "Google Trust Services / WE1",
            "subject": "typedream.app"
        },
        "dns": {
            "A": [
                "188.114.97.9",
                "188.114.96.9"
            ]
        },
        "dnssec": {
            "ds": false,
            "rrsig": false,
            "dnskey": false
        },
        "hsts": {
            "message": "Site does not serve any HSTS headers."
        },
        "http_security": {
            "xFrameOptions": false,
            "referrerPolicy": false,
            "xXSSProtection": false,
            "permissionsPolicy": false,
            "xContentTypeOptions": false,
            "contentSecurityPolicy": false,
            "strictTransportPolicy": false,
            "crossOriginOpenerPolicy": false,
            "crossOriginEmbedderPolicy": false,
            "crossOriginResourcePolicy": false
        },
        "firewall": {
            "waf": "Cloudflare",
            "has_waf": true
        },
        "get_ip": {
            "ip": "188.114.97.9",
            "family": 4
        },
        "redirects": {
            "chain": [
                "https://safe-ldgreliveapp.typedream.app"
            ]
        },
        "tech_stack": {
            "technologies": [
                "Node.js",
                "React",
                "Google Cloud",
                "Next.js",
                "cdnjs",
                "Quicklink",
                "Google Font API",
                "Google Cloud CDN",
                "Cloudflare",
                "Webpack",
                "Open Graph",
                "Module Federation",
                "HTTP/3"
            ]
        },
        "social_presence": {
            "profiles": [
                "https://x.com/typedreamHQ"
            ]
        },
        "linked_pages": {
            "external": [
                "https://www.ledger.com/ledger-live",
                "https://typedream.com/",
                "https://typedream.com/"
            ],
            "external_count": 3,
            "internal_count": 1
        },
        "headers": {
            "headers": {
                "server": "cloudflare",
                "content-type": "text/html; charset=utf-8",
                "x-powered-by": "Next.js"
            }
        }
    }
}
```