Phishing Analysis
Detailed analysis of captured phishing page
Visual Capture
Detection Info
https://aps-ledgerlive-com.typedream.app/
Detected Brand
Ledger
Country
International
Confidence
100%
HTTP Status
200
Report ID
08265280-b0a…
Analyzed
2026-02-18 03:27
Content Hashes (HTML Similarity)
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T1DA63FB962495601A076340D394BB2B8AB3791C2FF92C15E1A4B8C7E572FC8F5316AF4F |
|
CONTENT
ssdeep
|
768:EyWuP/QX11WjwqCyTHubZ/55coqBs/uLQtLnWr29MFlo6LjMRt8n+D+McNwUX8UO:y8yOloQzZs8oWQbp |
Visual Hashes (Screenshot Similarity)
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
91eeee99e152106d |
|
VISUAL
aHash
|
ffff004e0a0e0000 |
|
VISUAL
dHash
|
031a1c989a9c1ccb |
|
VISUAL
wHash
|
ffff0e6e0e0f0020 |
|
VISUAL
colorHash
|
324010000c0 |
|
VISUAL
cropResistant
|
030041d696c20203,fca4a4b0b6eacec3,0000000000020408,60c4848480828280,030303c3d3030303,1afc989a98dc00cb |
Code Analysis
Risk Score
100/100
Threat Level
ALTO
⚠️ Phishing Confirmed
🎣 Credential Harvester
🎣 OTP Stealer
🎣 Card Stealer
🎣 Banking
🎣 Personal Info
🔬 Threat Analysis Report
• Threat: Impersonation
• Target: Ledger users
• Method: Malicious website mimicking the Ledger site.
• Exfil: Potentially theft of funds via compromised wallet info
• Indicators: Domain mismatch, free hosting, JavaScript obfuscation.
• Risk: HIGH
🔒 Obfuscation Detected
- fromCharCode
- unescape
- unicode_escape
🎯 Kit Endpoints
- https://aps-ledgerlive-com.typedream.app/api/exfiltrate
📡 API Calls Detected
- https://typedream.com/forms?utm_source=form-thank-you-page:
- GET
- POST
📊 Risk Score Breakdown
Total Risk Score
90/100
Contributing Factors
Free Hosting
Website is hosted on a free platform (Typedream.app), indicating potential malicious intent.
Domain Mismatch
Domain is not the official Ledger domain.
Impersonation
The site is designed to look like the official Ledger website.
🔬 Comprehensive Threat Analysis
Threat Type
Banking Credential Harvester
Target
Ledger users (International)
Attack Method
Brand impersonation + obfuscated JavaScript
Exfiltration Channel
Form submission (backend endpoint not detected - likely JavaScript-based)
Risk Assessment
CRITICAL - Automated credential harvesting with Form submission (backend endpoint not detected - likely JavaScript-based)
⚠️ Indicators of Compromise
- Kit types: Credential Harvester, OTP Stealer, Card Stealer, Banking, Personal Info
- 704 obfuscation techniques
🏢 Brand Impersonation Analysis
Impersonated Brand
Ledger
Official Website
https://www.ledger.com/
Fake Service
Ledger Website
⚔️ Attack Methodology
Primary Method: Impersonation
The attacker is attempting to mimic the appearance of the Ledger website to trick users into providing sensitive information.
🌐 Infrastructure Indicators of Compromise
🦠 Malicious Files
Main File
_next/static/chunks/8070-b455d31b248b2b1a.js
File Size
📊 Attack Flow Diagram
User fills <input name='wallet'> → $5cb92bef7577960e$var$handleAndDispatchCustomEvent() → fetch('https://aps-ledgerlive-com.typedream.app/api/exfiltrate') → Data sent to attacker
🔬 JavaScript Deep Analysis
Operator Language
English (1%)
Total Code Size
894.9 KB
🔗 API Endpoints Detected
Other
29
🔐 Obfuscation Detected
- : Moderate
- : Light
- : Light
- : Moderate
- : Light
- : Light
- : Light
- : Heavy
- : Light
- : None
- : Light
- : Moderate
- : Light
- : Light
- : Light
- : Light
- : None
- : None
- : None
🤖 AI-Extracted Threat Intelligence
📊 Attack Flow
User fills <input name='wallet'> → $5cb92bef7577960e$var$handleAndDispatchCustomEvent() → fetch('https://aps-ledgerlive-com.typedream.app/api/exfiltrate') → Data sent to attacker
🎯 Malicious Files Identified
Main Drainer
_next/static/chunks/8070-b455d31b248b2b1a.jsFile Size
45KB
Malicious Functions
$5cb92bef7577960e$var$handleAndDispatchCustomEvent
Similar Websites
Pages with identical visual appearance (based on perceptual hash)
Ledger
https://us-conect-ledger-live-login.typedream.app/
Mar 27, 2026
Ledger
https://us-conect-ledger-live-login.typedream.app/
Mar 25, 2026
Ledger
https://sso-web-ledger-ledger-live-login.typedream.app/
Feb 27, 2026
Ledger
https://aps-ledgerlive-com.typedream.app/
Feb 25, 2026
Ledger
https://ledger-live-app-start-web-conect.typedream.app
Feb 17, 2026
Scan History for aps-ledgerlive-com.typedream.app
Found 1 other scan for this domain
"I Never Thought It Would Happen to Me"
That's what 2.3 million victims say every year. Don't wait to become a statistic.