What happened
The urlDNA scanning service posted on Mastodon on 11 November 2026 that hxxps://windows-ledger-live.typedream.app is a possible phishing page, linking its scan. The domain also appears on the Phishing Army extended blocklist, a public phishing domain blocklist. The page uses the name of Ledger Live, the app for Ledger hardware crypto wallets. typedream.app is a shared site-builder domain; only this subdomain is reported here, and Typedream and Ledger are not the operators. Download Ledger Live only from ledger.com and never type your recovery phrase into any website or app prompt.
How the scam works
Wallet and exchange phishing pages often follow an email, comment or advert that says you must confirm your account, update an app or claim a token credit. The page may ask for a recovery phrase, a private key or a password. Official wallet apps and hardware devices never need those words to be typed into a website. Close the page, open only the official app or a bookmark you already use, and if you entered a phrase treat the wallet as compromised and move funds to a new wallet whose phrase you created offline, if you still can.
windows-ledger-live.typedream.app is a Typedream site, not Ledger's official download page. Ledger was impersonated and is not involved. Ledger Live is installed only from Ledger's official site or store listing, and a recovery phrase is entered only on the hardware device itself, never in a browser form. A fake Magic Eden wallet page and a Trust Wallet look-alike domain were also flagged the same day.
Source
Public post on Mastodon, 11 November 2026: https://infosec.exchange/@urldna/117596632763339218
The indicators come from this source and have not been independently checked by scammers.com.
