Phishing Analysis
Detailed analysis of captured phishing page
Visual Capture
Detection Info
http://support-legderlive-us--learn.typedream.app/
Detected Brand
Ledger
Country
International
Confidence
100%
HTTP Status
200
Report ID
c91d4bea-1d5…
Analyzed
2026-03-17 17:09
Final URL (after redirects)
https://support-legderlive-us--learn.typedream.app/
Content Hashes (HTML Similarity)
Used to detect similar phishing pages based on HTML content
| Algorithm | Hash Value |
|---|---|
|
CONTENT
TLSH
|
T116732A4D5451602E873B40F388B71FC8B7385C1FF91902E295B887A6B39D9F5326AB4B |
|
CONTENT
ssdeep
|
768:AyWujwqPyW/18n+sutgX8Uv4ILshJk8347XXalAteIy+ZPYOe5Uxussh6qGqn2gn:iyqyOloQzZs8oWQbp |
Visual Hashes (Screenshot Similarity)
Used to detect visually similar phishing pages based on screenshots
| Algorithm | Hash Value |
|---|---|
|
VISUAL
pHash
|
b32264c9cdcccdac |
|
VISUAL
aHash
|
e7c7c7c7c7efc7c7 |
|
VISUAL
dHash
|
0c0d0d1c1c1c1e1e |
|
VISUAL
wHash
|
c3c3c3c3c3c7c3c2 |
|
VISUAL
colorHash
|
07000000000 |
|
VISUAL
cropResistant
|
0c0d0d1c1c1c1e1e |
Code Analysis
Risk Score
79/100
Threat Level
MEDIO
⚠️ Phishing Confirmed
🎣 Credential Harvester
🎣 OTP Stealer
🎣 Card Stealer
🎣 Banking
🎣 Personal Info
🔬 Threat Analysis Report
• Threat: Impersonation
• Target: Ledger users
• Method: Mimicking Ledger content on a different domain.
• Exfil: Unclear. This is likely the first stage, with intent to later phish.
• Indicators: Domain, hosting, content style.
• Risk: Moderate.
🔒 Obfuscation Detected
- fromCharCode
- unescape
- unicode_escape
📡 API Calls Detected
- GET
- https://typedream.com/forms?utm_source=form-thank-you-page:
- POST
📊 Risk Score Breakdown
Total Risk Score
65/100
Contributing Factors
Domain Mismatch
The domain does not belong to the official Ledger website.
Hosting Provider
Uses Typedream, a popular free hosting service that allows easy scam setup.
Impersonation
Content and branding mimic Ledger, increasing user trust for a potential scam.
🔬 Comprehensive Threat Analysis
Threat Type
Banking Credential Harvester
Target
Ledger users (International)
Attack Method
Brand impersonation + obfuscated JavaScript
Exfiltration Channel
Form submission (backend endpoint not detected - likely JavaScript-based)
Risk Assessment
HIGH - Automated credential harvesting with Form submission (backend endpoint not detected - likely JavaScript-based)
⚠️ Indicators of Compromise
- Kit types: Credential Harvester, OTP Stealer, Card Stealer, Banking, Personal Info
- 695 obfuscation techniques
🏢 Brand Impersonation Analysis
Impersonated Brand
Ledger
Official Website
https://www.ledger.com/
Fake Service
Ledger Live information
⚔️ Attack Methodology
Primary Method: Brand Impersonation
The site mimics Ledger content to create a false sense of security, which is a common approach to get users to enter credentials or visit malicious links.
Secondary Method: Social engineering
Exploiting user trust by mimicking the brand’s style and content, which is used to redirect to phishing login pages or malicious websites.
🌐 Infrastructure Indicators of Compromise
Domain Information
Domain
support-legderlive-us--learn.typedream.app
Registered
None
Registrar
None
Status
None
🤖 AI-Extracted Threat Intelligence
Similar Websites
Pages with identical visual appearance (based on perceptual hash)
Scan History for support-legderlive-us--learn.typedream.app
Found 2 other scans for this domain
"I Never Thought It Would Happen to Me"
That's what 2.3 million victims say every year. Don't wait to become a statistic.