en-ledger-com-us-en-live[.]typedream[.]app

This domain, en-ledger-com-us-en-live.typedream.app, is actively impersonating Ledger, a cryptocurrency wallet provider, as of July 24, 2026. Analysis indicates a high-risk brand impersonation threat targeting users of Ledger Live, the official wallet management application. The page title explicitly replicates the legitimate Ledger Live branding: 'Ledger Live – Secure Crypto Wallet App for Managing Digital.' The domain resolves to IP 104.21.37.85, hosted on Cloudflare’s infrastructure (AS13335), and returns an HTTP 200 status, confirming the site is operational. SSL certification is provided by Google Trust Services (WE1), which does not inherently validate legitimacy. Detection data shows 18 of 93 security vendors on VirusTotal flagging the domain as malicious.

Google Safe Browsing classifies it as social engineering, and it appears on at least one security blocklist. The domain was registered on January 22, 2021, through Squarespace Domains II LLC, and uses Cloudflare nameservers (annalise.ns.cloudflare.com, darwin.ns.cloudflare.com). Detected technologies include Node.js, React, Next.js, and Google Cloud services, suggesting a modern web stack likely used to replicate the appearance of a legitimate crypto wallet interface. Defenders should treat this domain as an active crypto scam threat.

The combination of brand impersonation, social engineering classification, and vendor detections warrants immediate blocking at the network and endpoint levels. No evidence confirms the exact nature of the scam (e.g., credential harvesting, crypto drainer, or fake wallet distribution), but the page title and scam type indicate an intent to deceive users into interacting with fraudulent crypto services. Infrastructure analysis reveals Cloudflare hosting, which is commonly used to obscure origin servers and evade takedowns. The domain remains active, and further monitoring is recommended to assess changes in behavior or additional detections.