portal-faq-ldger-live-autho[.]typedream[.]app

This domain is flagged for elevated-risk brand impersonation, specifically targeting Ledger, a hardware wallet provider. The threat involves a fraudulent login page mimicking Ledger Live’s official authentication portal, designed to harvest credentials or sensitive financial data from users under false pretenses. Analysis indicates the domain portal-faq-ldger-live-autho.typedream.app was registered on February 21, 2026, through Squarespace Domains II LLC. It resolves to the IP address 188.114.97.3, hosted on Cloudflare’s infrastructure (AS13335) in the United States. VirusTotal reports 20 out of 95 security vendors detecting the domain as malicious. The page title, "Ledger® Live: Login | (en-US) | Ledger Support," directly replicates the branding of the legitimate Ledger Live platform. The domain appears on one security blocklist, and its SSL certificate is issued by Google Trust Services (WE1). Current infrastructure status is offline, though prior activity remains a concern. Mitigation requires immediate action from security teams and end-users. Organizations should block the domain and its resolving IP (188.114.97.3) at the network perimeter. Endpoint protection systems must be updated to recognize the domain’s indicators of compromise, including its SSL certificate thumbprint and associated page title. Users who may have interacted with the domain should reset credentials for Ledger Live and any linked financial accounts, while enabling multi-factor authentication where available. Monitoring for similar impersonation domains using Ledger’s branding or variations of "Live" and "Support" in the URL structure is recommended to prevent further exposure.