{ "id": 733, "key": "4e4f2ab7bba1", "size": 9, "host_count": 9, "active_count": 9, "brands": [ "ledger", "trezor" ], "confidence": "suspected cluster", "confidence_score": 0.579, "confidence_metrics": { "B": 0.05, "D": 0.285, "S": 1.0, "T": 0.978, "V": 1.0 }, "first_seen": "2026-08-07 01:01:18.631009+00:00", "last_activity": "2026-08-29 13:18:44.733086+00:00", "top_evidence": { "type": "same_ns_set", "coverage": "9/9 members" }, "url": "https://phishunt.io/campaigns/4e4f2ab7bba1/", "algorithm_version": "corr-1.3.0", "generated_at": "2026-09-13T05:00:39.292856+00:00", "evidence_summary": [ { "type": "same_ns_set", "value": "annalise.ns.cloudflare.com,darwin.ns.cloudflare.com", "members_matching": 9 }, { "type": "apex_subdomain_overlap", "value": "typedream.app", "members_matching": 9 }, { "type": "same_registrar", "value": "Squarespace Domains II LLC.", "members_matching": 9 }, { "type": "shared_distinctive_token", "value": "typedream", "members_matching": 8 }, { "type": "cert_fingerprint_exact", "value": "ab441e0ffa6b15dd7c83fe1fe0e35948cc4fafcbe4787eb2ec7c78bb57a9a4d6", "members_matching": 6 }, { "type": "temporal_24h", "value": "0.0h", "members_matching": 6 }, { "type": "screenshot_phash_full", "value": "aa55aa55aa55aa55~aa55aa55aa55aa55 d=0", "members_matching": 5 }, { "type": "shared_distinctive_token", "value": "live", "members_matching": 4 }, { "type": "shared_distinctive_token", "value": "start", "members_matching": 4 }, { "type": "temporal_24h", "value": "11.8h", "members_matching": 4 }, { "type": "shared_distinctive_token", "value": "conect", "members_matching": 3 }, { "type": "screenshot_phash_partial", "value": "aa55aa55aa55aa55~ca152a752ad5aa75 d=8", "members_matching": 3 }, { "type": "temporal_24h", "value": "12.3h", "members_matching": 3 }, { "type": "temporal_72h", "value": "36.0h", "members_matching": 3 }, { "type": "temporal_72h", "value": "24.2h", "members_matching": 3 }, { "type": "temporal_7d", "value": "156.0h", "members_matching": 3 }, { "type": "temporal_72h", "value": "24.1h", "members_matching": 2 }, { "type": "temporal_72h", "value": "48.3h", "members_matching": 2 }, { "type": "temporal_72h", "value": "24.0h", "members_matching": 2 } ], "first_tracked": "2026-09-08T05:00:33.765344+00:00", "history": [ { "at": "2026-09-08T05:00:33.765344+00:00", "event": "created", "size": 9, "joined": [ "home-ledgrreliveapp.typedream.app", "ledger-live-download-sso-conect.typedream.app", "ledger-live-wallet-start-conect-us-en.typedream.app", "sso-ledger-live-strt-ledger-support-cdn.typedream.app", "start-web-en-ledger-live-login.typedream.app", "support-ledgrcom-start-web.typedream.app", "trezor-login-us-auth-start.typedream.app", "web-conect-us-ledger-live-wallet.typedream.app", "windows-ledger-live.typedream.app" ], "left": [] } ], "members": [ { "uuid": "af0f53fc-14ac-45cd-84c2-d68a7d7fef32", "domain": "home-ledgrreliveapp.typedream.app", "registrable_domain": "home-ledgrreliveapp.typedream.app", "url": "https://home-ledgrreliveapp.typedream.app", "company": "ledger", "status": "active", "first_seen": "2026-08-29 13:18:44.733086+00:00", "relationship_score": 60, "relationship_tier": "medium", "detail_url": "https://phishunt.io/suspicious/ledger/af0f53fc-14ac-45cd-84c2-d68a7d7fef32/", "image": "screenshots/ledger/af0f53fc-14ac-45cd-84c2-d68a7d7fef32.png", "phishunt_score": 39, "ip": "188.114.97.3", "asn": "13335", "org": "Cloudflare, Inc.", "country": "United States", "registrar": "Squarespace Domains II LLC.", "cert": "WE1", "gsb_category": "", "malicious_google": "0", "malicious_openphish": "1", "malicious_phishtank": "0", "malicious_tweetfeed": "0", "malicious_urlscan": "0" }, { "uuid": "2b2bcc96-b2d2-499a-8f24-08ff22af2a4e", "domain": "ledger-live-download-sso-conect.typedream.app", "registrable_domain": "ledger-live-download-sso-conect.typedream.app", "url": "https://ledger-live-download-sso-conect.typedream.app", "company": "ledger", "status": "active", "first_seen": "2026-08-13 13:02:43.020719+00:00", "relationship_score": 52, "relationship_tier": "medium", "detail_url": "https://phishunt.io/suspicious/ledger/2b2bcc96-b2d2-499a-8f24-08ff22af2a4e/", "image": "screenshots/ledger/c8f89601-3bbb-40a6-b2c8-830a6666d03e.png", "phishunt_score": 35, "ip": "188.114.97.3", "asn": "13335", "org": "Cloudflare, Inc.", "country": "United States", "registrar": "Squarespace Domains II LLC.", "cert": "-", "gsb_category": "", "malicious_google": "0", "malicious_openphish": "1", "malicious_phishtank": "0", "malicious_tweetfeed": "0", "malicious_urlscan": "0" }, { "uuid": "2e7035af-c99a-4654-a399-fdc3ac2d1478", "domain": "ledger-live-wallet-start-conect-us-en.typedream.app", "registrable_domain": "ledger-live-wallet-start-conect-us-en.typedream.app", "url": "https://ledger-live-wallet-start-conect-us-en.typedream.app", "company": "ledger", "status": "active", "first_seen": "2026-08-13 13:02:49.394155+00:00", "relationship_score": 52, "relationship_tier": "medium", "detail_url": "https://phishunt.io/suspicious/ledger/2e7035af-c99a-4654-a399-fdc3ac2d1478/", "image": "screenshots/ledger/241aed47-3682-4d8a-9978-0deebdadca72.png", "phishunt_score": 35, "ip": "188.114.96.3", "asn": "13335", "org": "Cloudflare, Inc.", "country": "United States", "registrar": "Squarespace Domains II LLC.", "cert": "-", "gsb_category": "", "malicious_google": "0", "malicious_openphish": "1", "malicious_phishtank": "0", "malicious_tweetfeed": "0", "malicious_urlscan": "0" }, { "uuid": "fa1617d5-29f3-4b4c-9262-d423310c8246", "domain": "sso-ledger-live-strt-ledger-support-cdn.typedream.app", "registrable_domain": "sso-ledger-live-strt-ledger-support-cdn.typedream.app", "url": "https://sso-ledger-live-strt-ledger-support-cdn.typedream.app", "company": "ledger", "status": "active", "first_seen": "2026-08-27 13:02:08.292012+00:00", "relationship_score": 50, "relationship_tier": "medium", "detail_url": "https://phishunt.io/suspicious/ledger/fa1617d5-29f3-4b4c-9262-d423310c8246/", "image": "screenshots/ledger/8f095445-3c6a-4b7e-9f0e-d221a976de6f.png", "phishunt_score": 40, "ip": "188.114.97.3", "asn": "13335", "org": "Cloudflare, Inc.", "country": "United States", "registrar": "Squarespace Domains II LLC.", "cert": "WE1", "gsb_category": "", "malicious_google": "0", "malicious_openphish": "1", "malicious_phishtank": "0", "malicious_tweetfeed": "0", "malicious_urlscan": "0" }, { "uuid": "22b0df35-b50a-4419-9f8c-dcef0fd1b8ce", "domain": "start-web-en-ledger-live-login.typedream.app", "registrable_domain": "start-web-en-ledger-live-login.typedream.app", "url": "https://start-web-en-ledger-live-login.typedream.app", "company": "ledger", "status": "active", "first_seen": "2026-08-29 01:03:10.261699+00:00", "relationship_score": 64, "relationship_tier": "high", "detail_url": "https://phishunt.io/suspicious/ledger/22b0df35-b50a-4419-9f8c-dcef0fd1b8ce/", "image": "screenshots/ledger/22b0df35-b50a-4419-9f8c-dcef0fd1b8ce-urlscan.png", "phishunt_score": 36, "ip": "188.114.97.3", "asn": "13335", "org": "Cloudflare, Inc.", "country": "United States", "registrar": "Squarespace Domains II LLC.", "cert": "WE1", "gsb_category": "", "malicious_google": "0", "malicious_openphish": "1", "malicious_phishtank": "0", "malicious_tweetfeed": "0", "malicious_urlscan": "0" }, { "uuid": "74c1c412-8196-4331-ba59-28bc79518616", "domain": "support-ledgrcom-start-web.typedream.app", "registrable_domain": "support-ledgrcom-start-web.typedream.app", "url": "https://support-ledgrcom-start-web.typedream.app", "company": "ledger", "status": "active", "first_seen": "2026-08-28 13:16:39.905697+00:00", "relationship_score": 52, "relationship_tier": "medium", "detail_url": "https://phishunt.io/suspicious/ledger/74c1c412-8196-4331-ba59-28bc79518616/", "image": "screenshots/ledger/74c1c412-8196-4331-ba59-28bc79518616.png", "phishunt_score": 39, "ip": "188.114.96.3", "asn": "13335", "org": "Cloudflare, Inc.", "country": "United States", "registrar": "Squarespace Domains II LLC.", "cert": "WE1", "gsb_category": "", "malicious_google": "0", "malicious_openphish": "1", "malicious_phishtank": "0", "malicious_tweetfeed": "0", "malicious_urlscan": "0" }, { "uuid": "73ac3f6d-0b65-47ff-9eb9-12215eef4cac", "domain": "trezor-login-us-auth-start.typedream.app", "registrable_domain": "trezor-login-us-auth-start.typedream.app", "url": "http://trezor-login-us-auth-start.typedream.app", "company": "trezor", "status": "active", "first_seen": "2026-08-07 01:01:18.631009+00:00", "relationship_score": 46, "relationship_tier": "medium", "detail_url": "https://phishunt.io/suspicious/trezor/73ac3f6d-0b65-47ff-9eb9-12215eef4cac/", "image": "screenshots/trezor/73ac3f6d-0b65-47ff-9eb9-12215eef4cac.png", "phishunt_score": 35, "ip": "188.114.96.3", "asn": "13335", "org": "Cloudflare, Inc.", "country": "United States", "registrar": "Squarespace Domains II LLC.", "cert": "-", "gsb_category": "", "malicious_google": "0", "malicious_openphish": "1", "malicious_phishtank": "0", "malicious_tweetfeed": "0", "malicious_urlscan": "0" }, { "uuid": "2711ec30-a33d-4ad0-9ed6-3f3653110f91", "domain": "web-conect-us-ledger-live-wallet.typedream.app", "registrable_domain": "web-conect-us-ledger-live-wallet.typedream.app", "url": "https://web-conect-us-ledger-live-wallet.typedream.app", "company": "ledger", "status": "active", "first_seen": "2026-08-28 13:15:35.794920+00:00", "relationship_score": 64, "relationship_tier": "high", "detail_url": "https://phishunt.io/suspicious/ledger/2711ec30-a33d-4ad0-9ed6-3f3653110f91/", "image": "screenshots/ledger/2711ec30-a33d-4ad0-9ed6-3f3653110f91-urlscan.png", "phishunt_score": 36, "ip": "188.114.96.3", "asn": "13335", "org": "Cloudflare, Inc.", "country": "United States", "registrar": "Squarespace Domains II LLC.", "cert": "WE1", "gsb_category": "", "malicious_google": "0", "malicious_openphish": "1", "malicious_phishtank": "0", "malicious_tweetfeed": "0", "malicious_urlscan": "0" }, { "uuid": "7241dbbd-1eba-4a72-a95b-a1b6d7c2d09c", "domain": "windows-ledger-live.typedream.app", "registrable_domain": "windows-ledger-live.typedream.app", "url": "https://windows-ledger-live.typedream.app", "company": "ledger", "status": "active", "first_seen": "2026-08-29 01:02:43.529338+00:00", "relationship_score": 52, "relationship_tier": "medium", "detail_url": "https://phishunt.io/suspicious/ledger/7241dbbd-1eba-4a72-a95b-a1b6d7c2d09c/", "image": "screenshots/ledger/77e1d5e8-c00b-40e8-82a9-5b6829e2d479.png", "phishunt_score": 42, "ip": "188.114.96.3", "asn": "13335", "org": "Cloudflare, Inc.", "country": "United States", "registrar": "Squarespace Domains II LLC.", "cert": "WE1", "gsb_category": "", "malicious_google": "0", "malicious_openphish": "1", "malicious_phishtank": "1", "malicious_tweetfeed": "0", "malicious_urlscan": "0" } ], "domains": [ { "domain": "home-ledgrreliveapp.typedream.app", "host_count": 1, "active_count": 1, "hosts": [ "home-ledgrreliveapp.typedream.app" ], "uuids": [ "af0f53fc-14ac-45cd-84c2-d68a7d7fef32" ] }, { "domain": "ledger-live-download-sso-conect.typedream.app", "host_count": 1, "active_count": 1, "hosts": [ "ledger-live-download-sso-conect.typedream.app" ], "uuids": [ "2b2bcc96-b2d2-499a-8f24-08ff22af2a4e" ] }, { "domain": "ledger-live-wallet-start-conect-us-en.typedream.app", "host_count": 1, "active_count": 1, "hosts": [ "ledger-live-wallet-start-conect-us-en.typedream.app" ], "uuids": [ "2e7035af-c99a-4654-a399-fdc3ac2d1478" ] }, { "domain": "sso-ledger-live-strt-ledger-support-cdn.typedream.app", "host_count": 1, "active_count": 1, "hosts": [ "sso-ledger-live-strt-ledger-support-cdn.typedream.app" ], "uuids": [ "fa1617d5-29f3-4b4c-9262-d423310c8246" ] }, { "domain": "start-web-en-ledger-live-login.typedream.app", "host_count": 1, "active_count": 1, "hosts": [ "start-web-en-ledger-live-login.typedream.app" ], "uuids": [ "22b0df35-b50a-4419-9f8c-dcef0fd1b8ce" ] }, { "domain": "support-ledgrcom-start-web.typedream.app", "host_count": 1, "active_count": 1, "hosts": [ "support-ledgrcom-start-web.typedream.app" ], "uuids": [ "74c1c412-8196-4331-ba59-28bc79518616" ] }, { "domain": "trezor-login-us-auth-start.typedream.app", "host_count": 1, "active_count": 1, "hosts": [ "trezor-login-us-auth-start.typedream.app" ], "uuids": [ "73ac3f6d-0b65-47ff-9eb9-12215eef4cac" ] }, { "domain": "web-conect-us-ledger-live-wallet.typedream.app", "host_count": 1, "active_count": 1, "hosts": [ "web-conect-us-ledger-live-wallet.typedream.app" ], "uuids": [ "2711ec30-a33d-4ad0-9ed6-3f3653110f91" ] }, { "domain": "windows-ledger-live.typedream.app", "host_count": 1, "active_count": 1, "hosts": [ "windows-ledger-live.typedream.app" ], "uuids": [ "7241dbbd-1eba-4a72-a95b-a1b6d7c2d09c" ] } ], "relationships": [ { "domain_a": "start-web-en-ledger-live-login.typedream.app", "domain_b": "web-conect-us-ledger-live-wallet.typedream.app", "detail_url_a": "https://phishunt.io/suspicious/ledger/22b0df35-b50a-4419-9f8c-dcef0fd1b8ce/", "detail_url_b": "https://phishunt.io/suspicious/ledger/2711ec30-a33d-4ad0-9ed6-3f3653110f91/", "score": 64, "tier": "high", "demotion_reason": null, "first_reproduced": "2026-08-29", "evidence": [ { "label": "same TLS cert", "signal": "cert_fingerprint_exact", "category": "tls", "contributed": 14.4, "idf_factor": 0.8, "dampened_by": null }, { "label": "same screenshot", "signal": "screenshot_phash_full", "category": "visual", "contributed": 12.8, "idf_factor": 0.8, "dampened_by": null }, { "label": "same nameservers", "signal": "same_ns_set", "category": "infra", "contributed": 11.2, "idf_factor": 0.8, "dampened_by": null }, { "label": "same apex", "signal": "apex_subdomain_overlap", "category": "infra", "contributed": 8.0, "idf_factor": 0.8, "dampened_by": null }, { "label": "similar name", "signal": "shared_distinctive_token", "category": "naming", "contributed": 8.0, "idf_factor": 0.8, "dampened_by": null }, { "label": "appeared together (24h)", "signal": "temporal_24h", "category": "temporal", "contributed": 6, "idf_factor": null, "dampened_by": null }, { "label": "same registrar", "signal": "same_registrar", "category": "registration", "contributed": 4, "idf_factor": null, "dampened_by": null } ], "discounted": [ { "label": "shared TLS SAN", "signal": "san_overlap", "category": "tls", "contributed": 0.0, "idf_factor": 0.8, "dampened_by": "cert_fingerprint_exact" }, { "label": "similar colors", "signal": "dominant_colors_match", "category": "visual", "contributed": 0.0, "idf_factor": null, "dampened_by": "screenshot_phash" } ] }, { "domain_a": "home-ledgrreliveapp.typedream.app", "domain_b": "start-web-en-ledger-live-login.typedream.app", "detail_url_a": "https://phishunt.io/suspicious/ledger/af0f53fc-14ac-45cd-84c2-d68a7d7fef32/", "detail_url_b": "https://phishunt.io/suspicious/ledger/22b0df35-b50a-4419-9f8c-dcef0fd1b8ce/", "score": 60, "tier": "medium", "demotion_reason": null, "first_reproduced": "2026-08-30", "evidence": [ { "label": "same TLS cert", "signal": "cert_fingerprint_exact", "category": "tls", "contributed": 14.4, "idf_factor": 0.8, "dampened_by": null }, { "label": "same nameservers", "signal": "same_ns_set", "category": "infra", "contributed": 11.2, "idf_factor": 0.8, "dampened_by": null }, { "label": "same apex", "signal": "apex_subdomain_overlap", "category": "infra", "contributed": 8.0, "idf_factor": 0.8, "dampened_by": null }, { "label": "similar name", "signal": "shared_distinctive_token", "category": "naming", "contributed": 8.0, "idf_factor": 0.8, "dampened_by": null }, { "label": "same screenshot", "signal": "screenshot_phash_partial", "category": "visual", "contributed": 8.0, "idf_factor": 0.8, "dampened_by": null }, { "label": "appeared together (24h)", "signal": "temporal_24h", "category": "temporal", "contributed": 6, "idf_factor": null, "dampened_by": null }, { "label": "same registrar", "signal": "same_registrar", "category": "registration", "contributed": 4, "idf_factor": null, "dampened_by": null } ], "discounted": [ { "label": "shared TLS SAN", "signal": "san_overlap", "category": "tls", "contributed": 0.0, "idf_factor": 0.8, "dampened_by": "cert_fingerprint_exact" } ] }, { "domain_a": "home-ledgrreliveapp.typedream.app", "domain_b": "web-conect-us-ledger-live-wallet.typedream.app", "detail_url_a": "https://phishunt.io/suspicious/ledger/af0f53fc-14ac-45cd-84c2-d68a7d7fef32/", "detail_url_b": "https://phishunt.io/suspicious/ledger/2711ec30-a33d-4ad0-9ed6-3f3653110f91/", "score": 58, "tier": "medium", "demotion_reason": null, "first_reproduced": "2026-08-30", "evidence": [ { "label": "same TLS cert", "signal": "cert_fingerprint_exact", "category": "tls", "contributed": 14.4, "idf_factor": 0.8, "dampened_by": null }, { "label": "same nameservers", "signal": "same_ns_set", "category": "infra", "contributed": 11.2, "idf_factor": 0.8, "dampened_by": null }, { "label": "same apex", "signal": "apex_subdomain_overlap", "category": "infra", "contributed": 8.0, "idf_factor": 0.8, "dampened_by": null }, { "label": "similar name", "signal": "shared_distinctive_token", "category": "naming", "contributed": 8.0, "idf_factor": 0.8, "dampened_by": null }, { "label": "same screenshot", "signal": "screenshot_phash_partial", "category": "visual", "contributed": 8.0, "idf_factor": 0.8, "dampened_by": null }, { "label": "same registrar", "signal": "same_registrar", "category": "registration", "contributed": 4, "idf_factor": null, "dampened_by": null }, { "label": "appeared together (72h)", "signal": "temporal_72h", "category": "temporal", "contributed": 4, "idf_factor": null, "dampened_by": null } ], "discounted": [ { "label": "shared TLS SAN", "signal": "san_overlap", "category": "tls", "contributed": 0.0, "idf_factor": 0.8, "dampened_by": "cert_fingerprint_exact" } ] }, { "domain_a": "ledger-live-download-sso-conect.typedream.app", "domain_b": "ledger-live-wallet-start-conect-us-en.typedream.app", "detail_url_a": "https://phishunt.io/suspicious/ledger/2b2bcc96-b2d2-499a-8f24-08ff22af2a4e/", "detail_url_b": "https://phishunt.io/suspicious/ledger/2e7035af-c99a-4654-a399-fdc3ac2d1478/", "score": 52, "tier": "medium", "demotion_reason": null, "first_reproduced": "2026-08-14", "evidence": [ { "label": "same screenshot", "signal": "screenshot_phash_full", "category": "visual", "contributed": 12.8, "idf_factor": 0.8, "dampened_by": null }, { "label": "same nameservers", "signal": "same_ns_set", "category": "infra", "contributed": 11.2, "idf_factor": 0.8, "dampened_by": null }, { "label": "similar name", "signal": "shared_distinctive_token", "category": "naming", "contributed": 10.0, "idf_factor": 1.0, "dampened_by": null }, { "label": "same apex", "signal": "apex_subdomain_overlap", "category": "infra", "contributed": 8.0, "idf_factor": 0.8, "dampened_by": null }, { "label": "appeared together (24h)", "signal": "temporal_24h", "category": "temporal", "contributed": 6, "idf_factor": null, "dampened_by": null }, { "label": "same registrar", "signal": "same_registrar", "category": "registration", "contributed": 4, "idf_factor": null, "dampened_by": null } ], "discounted": [ { "label": "similar colors", "signal": "dominant_colors_match", "category": "visual", "contributed": 0.0, "idf_factor": null, "dampened_by": "screenshot_phash" } ] }, { "domain_a": "home-ledgrreliveapp.typedream.app", "domain_b": "windows-ledger-live.typedream.app", "detail_url_a": "https://phishunt.io/suspicious/ledger/af0f53fc-14ac-45cd-84c2-d68a7d7fef32/", "detail_url_b": "https://phishunt.io/suspicious/ledger/7241dbbd-1eba-4a72-a95b-a1b6d7c2d09c/", "score": 52, "tier": "medium", "demotion_reason": null, "first_reproduced": "2026-08-30", "evidence": [ { "label": "same TLS cert", "signal": "cert_fingerprint_exact", "category": "tls", "contributed": 14.4, "idf_factor": 0.8, "dampened_by": null }, { "label": "same nameservers", "signal": "same_ns_set", "category": "infra", "contributed": 11.2, "idf_factor": 0.8, "dampened_by": null }, { "label": "same apex", "signal": "apex_subdomain_overlap", "category": "infra", "contributed": 8.0, "idf_factor": 0.8, "dampened_by": null }, { "label": "similar name", "signal": "shared_distinctive_token", "category": "naming", "contributed": 8.0, "idf_factor": 0.8, "dampened_by": null }, { "label": "appeared together (24h)", "signal": "temporal_24h", "category": "temporal", "contributed": 6, "idf_factor": null, "dampened_by": null }, { "label": "same registrar", "signal": "same_registrar", "category": "registration", "contributed": 4, "idf_factor": null, "dampened_by": null } ], "discounted": [ { "label": "shared TLS SAN", "signal": "san_overlap", "category": "tls", "contributed": 0.0, "idf_factor": 0.8, "dampened_by": "cert_fingerprint_exact" } ] }, { "domain_a": "start-web-en-ledger-live-login.typedream.app", "domain_b": "support-ledgrcom-start-web.typedream.app", "detail_url_a": "https://phishunt.io/suspicious/ledger/22b0df35-b50a-4419-9f8c-dcef0fd1b8ce/", "detail_url_b": "https://phishunt.io/suspicious/ledger/74c1c412-8196-4331-ba59-28bc79518616/", "score": 52, "tier": "medium", "demotion_reason": null, "first_reproduced": "2026-08-29", "evidence": [ { "label": "same TLS cert", "signal": "cert_fingerprint_exact", "category": "tls", "contributed": 14.4, "idf_factor": 0.8, "dampened_by": null }, { "label": "same nameservers", "signal": "same_ns_set", "category": "infra", "contributed": 11.2, "idf_factor": 0.8, "dampened_by": null }, { "label": "same apex", "signal": "apex_subdomain_overlap", "category": "infra", "contributed": 8.0, "idf_factor": 0.8, "dampened_by": null }, { "label": "similar name", "signal": "shared_distinctive_token", "category": "naming", "contributed": 8.0, "idf_factor": 0.8, "dampened_by": null }, { "label": "appeared together (24h)", "signal": "temporal_24h", "category": "temporal", "contributed": 6, "idf_factor": null, "dampened_by": null }, { "label": "same registrar", "signal": "same_registrar", "category": "registration", "contributed": 4, "idf_factor": null, "dampened_by": null } ], "discounted": [ { "label": "shared TLS SAN", "signal": "san_overlap", "category": "tls", "contributed": 0.0, "idf_factor": 0.8, "dampened_by": "cert_fingerprint_exact" } ] }, { "domain_a": "start-web-en-ledger-live-login.typedream.app", "domain_b": "windows-ledger-live.typedream.app", "detail_url_a": "https://phishunt.io/suspicious/ledger/22b0df35-b50a-4419-9f8c-dcef0fd1b8ce/", "detail_url_b": "https://phishunt.io/suspicious/ledger/7241dbbd-1eba-4a72-a95b-a1b6d7c2d09c/", "score": 52, "tier": "medium", "demotion_reason": null, "first_reproduced": "2026-08-29", "evidence": [ { "label": "same TLS cert", "signal": "cert_fingerprint_exact", "category": "tls", "contributed": 14.4, "idf_factor": 0.8, "dampened_by": null }, { "label": "same nameservers", "signal": "same_ns_set", "category": "infra", "contributed": 11.2, "idf_factor": 0.8, "dampened_by": null }, { "label": "same apex", "signal": "apex_subdomain_overlap", "category": "infra", "contributed": 8.0, "idf_factor": 0.8, "dampened_by": null }, { "label": "similar name", "signal": "shared_distinctive_token", "category": "naming", "contributed": 8.0, "idf_factor": 0.8, "dampened_by": null }, { "label": "appeared together (24h)", "signal": "temporal_24h", "category": "temporal", "contributed": 6, "idf_factor": null, "dampened_by": null }, { "label": "same registrar", "signal": "same_registrar", "category": "registration", "contributed": 4, "idf_factor": null, "dampened_by": null } ], "discounted": [ { "label": "shared TLS SAN", "signal": "san_overlap", "category": "tls", "contributed": 0.0, "idf_factor": 0.8, "dampened_by": "cert_fingerprint_exact" } ] }, { "domain_a": "support-ledgrcom-start-web.typedream.app", "domain_b": "web-conect-us-ledger-live-wallet.typedream.app", "detail_url_a": "https://phishunt.io/suspicious/ledger/74c1c412-8196-4331-ba59-28bc79518616/", "detail_url_b": "https://phishunt.io/suspicious/ledger/2711ec30-a33d-4ad0-9ed6-3f3653110f91/", "score": 52, "tier": "medium", "demotion_reason": null, "first_reproduced": "2026-08-29", "evidence": [ { "label": "same TLS cert", "signal": "cert_fingerprint_exact", "category": "tls", "contributed": 14.4, "idf_factor": 0.8, "dampened_by": null }, { "label": "same nameservers", "signal": "same_ns_set", "category": "infra", "contributed": 11.2, "idf_factor": 0.8, "dampened_by": null }, { "label": "same apex", "signal": "apex_subdomain_overlap", "category": "infra", "contributed": 8.0, "idf_factor": 0.8, "dampened_by": null }, { "label": "similar name", "signal": "shared_distinctive_token", "category": "naming", "contributed": 8.0, "idf_factor": 0.8, "dampened_by": null }, { "label": "appeared together (24h)", "signal": "temporal_24h", "category": "temporal", "contributed": 6, "idf_factor": null, "dampened_by": null }, { "label": "same registrar", "signal": "same_registrar", "category": "registration", "contributed": 4, "idf_factor": null, "dampened_by": null } ], "discounted": [ { "label": "shared TLS SAN", "signal": "san_overlap", "category": "tls", "contributed": 0.0, "idf_factor": 0.8, "dampened_by": "cert_fingerprint_exact" } ] }, { "domain_a": "support-ledgrcom-start-web.typedream.app", "domain_b": "windows-ledger-live.typedream.app", "detail_url_a": "https://phishunt.io/suspicious/ledger/74c1c412-8196-4331-ba59-28bc79518616/", "detail_url_b": "https://phishunt.io/suspicious/ledger/7241dbbd-1eba-4a72-a95b-a1b6d7c2d09c/", "score": 52, "tier": "medium", "demotion_reason": null, "first_reproduced": "2026-08-29", "evidence": [ { "label": "same TLS cert", "signal": "cert_fingerprint_exact", "category": "tls", "contributed": 14.4, "idf_factor": 0.8, "dampened_by": null }, { "label": "same nameservers", "signal": "same_ns_set", "category": "infra", "contributed": 11.2, "idf_factor": 0.8, "dampened_by": null }, { "label": "same apex", "signal": "apex_subdomain_overlap", "category": "infra", "contributed": 8.0, "idf_factor": 0.8, "dampened_by": null }, { "label": "similar name", "signal": "shared_distinctive_token", "category": "naming", "contributed": 8.0, "idf_factor": 0.8, "dampened_by": null }, { "label": "appeared together (24h)", "signal": "temporal_24h", "category": "temporal", "contributed": 6, "idf_factor": null, "dampened_by": null }, { "label": "same registrar", "signal": "same_registrar", "category": "registration", "contributed": 4, "idf_factor": null, "dampened_by": null } ], "discounted": [ { "label": "shared TLS SAN", "signal": "san_overlap", "category": "tls", "contributed": 0.0, "idf_factor": 0.8, "dampened_by": "cert_fingerprint_exact" } ] }, { "domain_a": "web-conect-us-ledger-live-wallet.typedream.app", "domain_b": "windows-ledger-live.typedream.app", "detail_url_a": "https://phishunt.io/suspicious/ledger/2711ec30-a33d-4ad0-9ed6-3f3653110f91/", "detail_url_b": "https://phishunt.io/suspicious/ledger/7241dbbd-1eba-4a72-a95b-a1b6d7c2d09c/", "score": 52, "tier": "medium", "demotion_reason": null, "first_reproduced": "2026-08-29", "evidence": [ { "label": "same TLS cert", "signal": "cert_fingerprint_exact", "category": "tls", "contributed": 14.4, "idf_factor": 0.8, "dampened_by": null }, { "label": "same nameservers", "signal": "same_ns_set", "category": "infra", "contributed": 11.2, "idf_factor": 0.8, "dampened_by": null }, { "label": "same apex", "signal": "apex_subdomain_overlap", "category": "infra", "contributed": 8.0, "idf_factor": 0.8, "dampened_by": null }, { "label": "similar name", "signal": "shared_distinctive_token", "category": "naming", "contributed": 8.0, "idf_factor": 0.8, "dampened_by": null }, { "label": "appeared together (24h)", "signal": "temporal_24h", "category": "temporal", "contributed": 6, "idf_factor": null, "dampened_by": null }, { "label": "same registrar", "signal": "same_registrar", "category": "registration", "contributed": 4, "idf_factor": null, "dampened_by": null } ], "discounted": [ { "label": "shared TLS SAN", "signal": "san_overlap", "category": "tls", "contributed": 0.0, "idf_factor": 0.8, "dampened_by": "cert_fingerprint_exact" } ] }, { "domain_a": "home-ledgrreliveapp.typedream.app", "domain_b": "sso-ledger-live-strt-ledger-support-cdn.typedream.app", "detail_url_a": "https://phishunt.io/suspicious/ledger/af0f53fc-14ac-45cd-84c2-d68a7d7fef32/", "detail_url_b": "https://phishunt.io/suspicious/ledger/fa1617d5-29f3-4b4c-9262-d423310c8246/", "score": 50, "tier": "medium", "demotion_reason": null, "first_reproduced": "2026-08-30", "evidence": [ { "label": "same TLS cert", "signal": "cert_fingerprint_exact", "category": "tls", "contributed": 14.4, "idf_factor": 0.8, "dampened_by": null }, { "label": "same nameservers", "signal": "same_ns_set", "category": "infra", "contributed": 11.2, "idf_factor": 0.8, "dampened_by": null }, { "label": "same apex", "signal": "apex_subdomain_overlap", "category": "infra", "contributed": 8.0, "idf_factor": 0.8, "dampened_by": null }, { "label": "similar name", "signal": "shared_distinctive_token", "category": "naming", "contributed": 8.0, "idf_factor": 0.8, "dampened_by": null }, { "label": "same registrar", "signal": "same_registrar", "category": "registration", "contributed": 4, "idf_factor": null, "dampened_by": null }, { "label": "appeared together (72h)", "signal": "temporal_72h", "category": "temporal", "contributed": 4, "idf_factor": null, "dampened_by": null } ], "discounted": [ { "label": "shared TLS SAN", "signal": "san_overlap", "category": "tls", "contributed": 0.0, "idf_factor": 0.8, "dampened_by": "cert_fingerprint_exact" } ] }, { "domain_a": "home-ledgrreliveapp.typedream.app", "domain_b": "support-ledgrcom-start-web.typedream.app", "detail_url_a": "https://phishunt.io/suspicious/ledger/af0f53fc-14ac-45cd-84c2-d68a7d7fef32/", "detail_url_b": "https://phishunt.io/suspicious/ledger/74c1c412-8196-4331-ba59-28bc79518616/", "score": 50, "tier": "medium", "demotion_reason": null, "first_reproduced": "2026-08-30", "evidence": [ { "label": "same TLS cert", "signal": "cert_fingerprint_exact", "category": "tls", "contributed": 14.4, "idf_factor": 0.8, "dampened_by": null }, { "label": "same nameservers", "signal": "same_ns_set", "category": "infra", "contributed": 11.2, "idf_factor": 0.8, "dampened_by": null }, { "label": "same apex", "signal": "apex_subdomain_overlap", "category": "infra", "contributed": 8.0, "idf_factor": 0.8, "dampened_by": null }, { "label": "similar name", "signal": "shared_distinctive_token", "category": "naming", "contributed": 8.0, "idf_factor": 0.8, "dampened_by": null }, { "label": "same registrar", "signal": "same_registrar", "category": "registration", "contributed": 4, "idf_factor": null, "dampened_by": null }, { "label": "appeared together (72h)", "signal": "temporal_72h", "category": "temporal", "contributed": 4, "idf_factor": null, "dampened_by": null } ], "discounted": [ { "label": "shared TLS SAN", "signal": "san_overlap", "category": "tls", "contributed": 0.0, "idf_factor": 0.8, "dampened_by": "cert_fingerprint_exact" } ] }, { "domain_a": "sso-ledger-live-strt-ledger-support-cdn.typedream.app", "domain_b": "start-web-en-ledger-live-login.typedream.app", "detail_url_a": "https://phishunt.io/suspicious/ledger/fa1617d5-29f3-4b4c-9262-d423310c8246/", "detail_url_b": "https://phishunt.io/suspicious/ledger/22b0df35-b50a-4419-9f8c-dcef0fd1b8ce/", "score": 50, "tier": "medium", "demotion_reason": null, "first_reproduced": "2026-08-29", "evidence": [ { "label": "same TLS cert", "signal": "cert_fingerprint_exact", "category": "tls", "contributed": 14.4, "idf_factor": 0.8, "dampened_by": null }, { "label": "same nameservers", "signal": "same_ns_set", "category": "infra", "contributed": 11.2, "idf_factor": 0.8, "dampened_by": null }, { "label": "same apex", "signal": "apex_subdomain_overlap", "category": "infra", "contributed": 8.0, "idf_factor": 0.8, "dampened_by": null }, { "label": "similar name", "signal": "shared_distinctive_token", "category": "naming", "contributed": 8.0, "idf_factor": 0.8, "dampened_by": null }, { "label": "same registrar", "signal": "same_registrar", "category": "registration", "contributed": 4, "idf_factor": null, "dampened_by": null }, { "label": "appeared together (72h)", "signal": "temporal_72h", "category": "temporal", "contributed": 4, "idf_factor": null, "dampened_by": null } ], "discounted": [ { "label": "shared TLS SAN", "signal": "san_overlap", "category": "tls", "contributed": 0.0, "idf_factor": 0.8, "dampened_by": "cert_fingerprint_exact" } ] }, { "domain_a": "sso-ledger-live-strt-ledger-support-cdn.typedream.app", "domain_b": "support-ledgrcom-start-web.typedream.app", "detail_url_a": "https://phishunt.io/suspicious/ledger/fa1617d5-29f3-4b4c-9262-d423310c8246/", "detail_url_b": "https://phishunt.io/suspicious/ledger/74c1c412-8196-4331-ba59-28bc79518616/", "score": 50, "tier": "medium", "demotion_reason": null, "first_reproduced": "2026-08-29", "evidence": [ { "label": "same TLS cert", "signal": "cert_fingerprint_exact", "category": "tls", "contributed": 14.4, "idf_factor": 0.8, "dampened_by": null }, { "label": "same nameservers", "signal": "same_ns_set", "category": "infra", "contributed": 11.2, "idf_factor": 0.8, "dampened_by": null }, { "label": "same apex", "signal": "apex_subdomain_overlap", "category": "infra", "contributed": 8.0, "idf_factor": 0.8, "dampened_by": null }, { "label": "similar name", "signal": "shared_distinctive_token", "category": "naming", "contributed": 8.0, "idf_factor": 0.8, "dampened_by": null }, { "label": "same registrar", "signal": "same_registrar", "category": "registration", "contributed": 4, "idf_factor": null, "dampened_by": null }, { "label": "appeared together (72h)", "signal": "temporal_72h", "category": "temporal", "contributed": 4, "idf_factor": null, "dampened_by": null } ], "discounted": [ { "label": "shared TLS SAN", "signal": "san_overlap", "category": "tls", "contributed": 0.0, "idf_factor": 0.8, "dampened_by": "cert_fingerprint_exact" } ] }, { "domain_a": "sso-ledger-live-strt-ledger-support-cdn.typedream.app", "domain_b": "web-conect-us-ledger-live-wallet.typedream.app", "detail_url_a": "https://phishunt.io/suspicious/ledger/fa1617d5-29f3-4b4c-9262-d423310c8246/", "detail_url_b": "https://phishunt.io/suspicious/ledger/2711ec30-a33d-4ad0-9ed6-3f3653110f91/", "score": 50, "tier": "medium", "demotion_reason": null, "first_reproduced": "2026-08-29", "evidence": [ { "label": "same TLS cert", "signal": "cert_fingerprint_exact", "category": "tls", "contributed": 14.4, "idf_factor": 0.8, "dampened_by": null }, { "label": "same nameservers", "signal": "same_ns_set", "category": "infra", "contributed": 11.2, "idf_factor": 0.8, "dampened_by": null }, { "label": "same apex", "signal": "apex_subdomain_overlap", "category": "infra", "contributed": 8.0, "idf_factor": 0.8, "dampened_by": null }, { "label": "similar name", "signal": "shared_distinctive_token", "category": "naming", "contributed": 8.0, "idf_factor": 0.8, "dampened_by": null }, { "label": "same registrar", "signal": "same_registrar", "category": "registration", "contributed": 4, "idf_factor": null, "dampened_by": null }, { "label": "appeared together (72h)", "signal": "temporal_72h", "category": "temporal", "contributed": 4, "idf_factor": null, "dampened_by": null } ], "discounted": [ { "label": "shared TLS SAN", "signal": "san_overlap", "category": "tls", "contributed": 0.0, "idf_factor": 0.8, "dampened_by": "cert_fingerprint_exact" } ] }, { "domain_a": "sso-ledger-live-strt-ledger-support-cdn.typedream.app", "domain_b": "windows-ledger-live.typedream.app", "detail_url_a": "https://phishunt.io/suspicious/ledger/fa1617d5-29f3-4b4c-9262-d423310c8246/", "detail_url_b": "https://phishunt.io/suspicious/ledger/7241dbbd-1eba-4a72-a95b-a1b6d7c2d09c/", "score": 50, "tier": "medium", "demotion_reason": null, "first_reproduced": "2026-08-29", "evidence": [ { "label": "same TLS cert", "signal": "cert_fingerprint_exact", "category": "tls", "contributed": 14.4, "idf_factor": 0.8, "dampened_by": null }, { "label": "same nameservers", "signal": "same_ns_set", "category": "infra", "contributed": 11.2, "idf_factor": 0.8, "dampened_by": null }, { "label": "same apex", "signal": "apex_subdomain_overlap", "category": "infra", "contributed": 8.0, "idf_factor": 0.8, "dampened_by": null }, { "label": "similar name", "signal": "shared_distinctive_token", "category": "naming", "contributed": 8.0, "idf_factor": 0.8, "dampened_by": null }, { "label": "same registrar", "signal": "same_registrar", "category": "registration", "contributed": 4, "idf_factor": null, "dampened_by": null }, { "label": "appeared together (72h)", "signal": "temporal_72h", "category": "temporal", "contributed": 4, "idf_factor": null, "dampened_by": null } ], "discounted": [ { "label": "shared TLS SAN", "signal": "san_overlap", "category": "tls", "contributed": 0.0, "idf_factor": 0.8, "dampened_by": "cert_fingerprint_exact" } ] }, { "domain_a": "ledger-live-download-sso-conect.typedream.app", "domain_b": "trezor-login-us-auth-start.typedream.app", "detail_url_a": "https://phishunt.io/suspicious/ledger/2b2bcc96-b2d2-499a-8f24-08ff22af2a4e/", "detail_url_b": "https://phishunt.io/suspicious/trezor/73ac3f6d-0b65-47ff-9eb9-12215eef4cac/", "score": 46, "tier": "medium", "demotion_reason": null, "first_reproduced": "2026-08-25", "evidence": [ { "label": "same screenshot", "signal": "screenshot_phash_full", "category": "visual", "contributed": 12.8, "idf_factor": 0.8, "dampened_by": null }, { "label": "same nameservers", "signal": "same_ns_set", "category": "infra", "contributed": 11.2, "idf_factor": 0.8, "dampened_by": null }, { "label": "same apex", "signal": "apex_subdomain_overlap", "category": "infra", "contributed": 8.0, "idf_factor": 0.8, "dampened_by": null }, { "label": "similar name", "signal": "shared_distinctive_token", "category": "naming", "contributed": 8.0, "idf_factor": 0.8, "dampened_by": null }, { "label": "same registrar", "signal": "same_registrar", "category": "registration", "contributed": 4, "idf_factor": null, "dampened_by": null }, { "label": "appeared together (7d)", "signal": "temporal_7d", "category": "temporal", "contributed": 2, "idf_factor": null, "dampened_by": null } ], "discounted": [ { "label": "similar colors", "signal": "dominant_colors_match", "category": "visual", "contributed": 0.0, "idf_factor": null, "dampened_by": "screenshot_phash" } ] }, { "domain_a": "ledger-live-download-sso-conect.typedream.app", "domain_b": "web-conect-us-ledger-live-wallet.typedream.app", "detail_url_a": "https://phishunt.io/suspicious/ledger/2b2bcc96-b2d2-499a-8f24-08ff22af2a4e/", "detail_url_b": "https://phishunt.io/suspicious/ledger/2711ec30-a33d-4ad0-9ed6-3f3653110f91/", "score": 46, "tier": "medium", "demotion_reason": null, "first_reproduced": "2026-08-29", "evidence": [ { "label": "same screenshot", "signal": "screenshot_phash_full", "category": "visual", "contributed": 12.8, "idf_factor": 0.8, "dampened_by": null }, { "label": "same nameservers", "signal": "same_ns_set", "category": "infra", "contributed": 11.2, "idf_factor": 0.8, "dampened_by": null }, { "label": "similar name", "signal": "shared_distinctive_token", "category": "naming", "contributed": 10.0, "idf_factor": 1.0, "dampened_by": null }, { "label": "same apex", "signal": "apex_subdomain_overlap", "category": "infra", "contributed": 8.0, "idf_factor": 0.8, "dampened_by": null }, { "label": "same registrar", "signal": "same_registrar", "category": "registration", "contributed": 4, "idf_factor": null, "dampened_by": null } ], "discounted": [ { "label": "similar colors", "signal": "dominant_colors_match", "category": "visual", "contributed": 0.0, "idf_factor": null, "dampened_by": "screenshot_phash" } ] }, { "domain_a": "ledger-live-wallet-start-conect-us-en.typedream.app", "domain_b": "trezor-login-us-auth-start.typedream.app", "detail_url_a": "https://phishunt.io/suspicious/ledger/2e7035af-c99a-4654-a399-fdc3ac2d1478/", "detail_url_b": "https://phishunt.io/suspicious/trezor/73ac3f6d-0b65-47ff-9eb9-12215eef4cac/", "score": 46, "tier": "medium", "demotion_reason": null, "first_reproduced": "2026-08-14", "evidence": [ { "label": "same screenshot", "signal": "screenshot_phash_full", "category": "visual", "contributed": 12.8, "idf_factor": 0.8, "dampened_by": null }, { "label": "same nameservers", "signal": "same_ns_set", "category": "infra", "contributed": 11.2, "idf_factor": 0.8, "dampened_by": null }, { "label": "same apex", "signal": "apex_subdomain_overlap", "category": "infra", "contributed": 8.0, "idf_factor": 0.8, "dampened_by": null }, { "label": "similar name", "signal": "shared_distinctive_token", "category": "naming", "contributed": 8.0, "idf_factor": 0.8, "dampened_by": null }, { "label": "same registrar", "signal": "same_registrar", "category": "registration", "contributed": 4, "idf_factor": null, "dampened_by": null }, { "label": "appeared together (7d)", "signal": "temporal_7d", "category": "temporal", "contributed": 2, "idf_factor": null, "dampened_by": null } ], "discounted": [ { "label": "similar colors", "signal": "dominant_colors_match", "category": "visual", "contributed": 0.0, "idf_factor": null, "dampened_by": "screenshot_phash" } ] }, { "domain_a": "ledger-live-wallet-start-conect-us-en.typedream.app", "domain_b": "web-conect-us-ledger-live-wallet.typedream.app", "detail_url_a": "https://phishunt.io/suspicious/ledger/2e7035af-c99a-4654-a399-fdc3ac2d1478/", "detail_url_b": "https://phishunt.io/suspicious/ledger/2711ec30-a33d-4ad0-9ed6-3f3653110f91/", "score": 46, "tier": "medium", "demotion_reason": null, "first_reproduced": "2026-08-29", "evidence": [ { "label": "same screenshot", "signal": "screenshot_phash_full", "category": "visual", "contributed": 12.8, "idf_factor": 0.8, "dampened_by": null }, { "label": "same nameservers", "signal": "same_ns_set", "category": "infra", "contributed": 11.2, "idf_factor": 0.8, "dampened_by": null }, { "label": "similar name", "signal": "shared_distinctive_token", "category": "naming", "contributed": 10.0, "idf_factor": 1.0, "dampened_by": null }, { "label": "same apex", "signal": "apex_subdomain_overlap", "category": "infra", "contributed": 8.0, "idf_factor": 0.8, "dampened_by": null }, { "label": "same registrar", "signal": "same_registrar", "category": "registration", "contributed": 4, "idf_factor": null, "dampened_by": null } ], "discounted": [ { "label": "similar colors", "signal": "dominant_colors_match", "category": "visual", "contributed": 0.0, "idf_factor": null, "dampened_by": "screenshot_phash" } ] } ], "relationships_truncated": false, "state": "live" }