Automated URL scanner urlDNA posted on Mastodon (infosec.exchange) on 10 November 2026 that portal-liv-e-ap-p-ledger[.]typedream[.]app is a possible phishing page. The address, built on the Typedream site builder, imi…
Source: infosec.exchange · published
Automated URL scanner urlDNA posted on Mastodon (infosec.exchange) on 10 November 2026 that portal-liv-e-ap-p-ledger[.]typedream[.]app is a possible phishing page. The address, built on the Typedream site builder, imitates a Ledger Live app portal and is on the Phishing Army blocklist. Ledger and Typedream are not the scammers. Ledger will never ask for your 24-word recovery phrase on a website; anyone who asks for it can empty your wallet.
The address portal-liv-e-ap-p-ledger.typedream.app is built on the Typedream site builder and imitates a Ledger Live app portal. Pages like this typically ask the visitor to enter a 24-word recovery phrase, connect a device, or approve a firmware or app update. Anyone who obtains a Ledger recovery phrase can empty the accounts it controls.
Ledger will never ask for a recovery phrase on a website. Ledger and Typedream are not the operators of this page, which is also on the Phishing Army blocklist. Use only the official Ledger Live application from Ledger's own site or the official app stores. The flag comes from an automated scanner and has not been independently checked by scammers.com.
Ledger devices are designed so that the recovery phrase is entered only on the hardware itself, not on a website and not in a site-builder portal. If a page asks for those words, close it. A genuinely lost or damaged device is recovered with the phrase you already wrote down, never by typing it into a 'portal' you reached from a message.
Public post on Mastodon, 10 November 2026: https://infosec.exchange/@urldna/117592035032182484
The indicators come from this source and have not been independently checked by scammers.com.
The phishing feed @PhishStats posted on X on 12 November 2026 a new phishing URL, hXXps://portal[.]stpmex[.]br[.]com/spei/login/, hosted at 217.151.99.216 (M247 Europe SRL, AS9009, Romania). The hostname and path use…
Anti-phishing project PhishDestroy posted on Mastodon on 12 November 2026 that zerion-inc[.]webflow[.]io is a suspected phishing site. Its domain record shows a page copying Zerion's wallet homepage ("Crypto Wallet fo…
The phishing-alert account @TheThreatWire posted on X on 12 November 2026 (Phishing Alert #141) that hxxps://2q7ci-niaaa-aaaad-qg66q-cai.icp0.io/index.html is a phishing page impersonating ICPesa, a Bitcoin and ckBTC…
MalwareTips published an investigation today rating deniudy.com a high-risk store that belongs to a scam network of near-identical shops sharing templates, product photos and return policies and reopening under new na…
MalwareTips published an investigation today rating thebakedbox.in a high-risk store that belongs to a scam network of near-identical shops sharing templates, product photos and return policies and reopening under new…
MalwareTips published an investigation today rating grace-bags.com a high-risk store that belongs to a scam network of near-identical shops sharing templates, product photos and return policies and reopening under new…