Catch phishing pages before blocklists do.
Muninn is a Chrome extension that scans pages as you browse and warns you when something looks off. Yggdrasil is the open threat database where suspicious URLs can be checked, reviewed, and shared.
Free during beta. Create an account to unlock deep scans, URL submissions, and the full Yggdrasil workflow.
Quiet by default. Thorough when it matters.
Muninn uses a two-step system to catch phishing pages before they slip by. The automatic scan checks each page in the background as you browse. If something looks suspicious, deep scan takes a closer look at what the page actually looks like.
That gives you a fast first pass on every page and a stronger second opinion when you want to investigate further.
Flagged 95% of URLs with later phishing evidence.
Runs quietly in the background while you browse.
Caught 98% of URLs later confirmed as phishing.
Screenshot-based analysis for a closer look.
See Muninn in action
This phishing page wasn't flagged by Chrome. Muninn caught it.
Recent entries in Yggdrasil
Open full view| URL | Status |
|---|---|
| https://ledger-com-portel.pages.dev Entity: Ledger | The URL uses a suspicious subdomain on a free hosting platform (pages.dev) and contains typosquatting ('portel' instead of 'portal') to mimic the official Ledger brand.; The page is a credential harvesting form impersonating Ledger Live, which typically operates as a local application rather than a web-based login portal on a third-party domain. | Phishing |
| https://ledgge-com-en.pages.dev Entity: Ledger | The URL uses a typo-squatted subdomain 'ledgge' instead of the official 'ledger' brand name to deceive users.; The site is hosted on a free 'pages.dev' cloud platform, a common tactic for phishing campaigns to bypass security filters and avoid domain registration scrutiny. | Phishing |
| https://www.walletflood.com Entity: E8体育 | The domain 'walletflood.com' is unrelated to the multiple sports betting and gambling brands displayed, a common pattern for phishing or fraudulent portal sites.; The visual content promotes high-stakes gambling and unrealistic bonuses, which are frequently used as bait for scams or unregulated activities. | Phishing |
| https://ledzer-starts-com.pages.dev Entity: Ledger | The domain uses a typosquatted version of the legitimate brand name ('ledzer' instead of 'ledger') which is a common phishing tactic.; The site is hosted on a free subdomain (pages.dev) while claiming to be an official service for a major hardware wallet brand. | Phishing |
| https://liveldgr.zapier.app/support Entity: Ledger | The website uses a third-party subdomain (zapier.app) to host content claiming to be official Ledger support, which is a classic indicator of a phishing attempt.; A legitimate security company like Ledger would host its official documentation and login guides on its own verified domain (ledger.com) rather than a free automation platform. | Phishing |
| https://iron-cryptowallet.pages.dev Entity: Iron Wallet | The application is hosted on a free subdomain (pages.dev), which is a common tactic for phishing sites seeking to exploit the reputation of the parent domain while avoiding costs and verification associated with professional domains.; Legitimate financial and cryptocurrency software providers utilize official, branded top-level domains for security and trust; hosting a non-custodial wallet interface on a generic hosting service is highly characteristic of credential harvesting scams. | Phishing |
| https://sso-leddger-live.pages.dev Entity: Ledger | The domain uses typo-squatting ('leddger' with an extra 'd') to mimic the legitimate Ledger brand.; The site is hosted on a free subdomain (pages.dev), which is highly atypical for a legitimate financial hardware wallet provider like Ledger. | Phishing |
| https://app-cexio-login.pages.dev Entity: CEX.io | The site uses a 'pages.dev' subdomain to mimic the official CEX.io brand, a common tactic for hosting phishing pages on legitimate cloud platforms.; The URL includes keywords like 'app' and 'login' while being disconnected from the official 'cex.io' domain, indicating an attempt to harvest user credentials. | Phishing |
| https://us-ledgrlive-desktop.pages.dev Entity: Ledger | The URL uses a misspelled version of the brand ('ledgr' instead of 'ledger') and is hosted on a generic subdomain (pages.dev) rather than the official company domain.; The page uses obfuscated text with diacritics in the main header (e.g., 'Lėdger') to bypass automated security filters, a classic indicator of a phishing site. | Phishing |
| https://spincasinologin-vip.pages.dev Entity: Spin Casino | The website is hosted on a free Cloudflare Pages subdomain (pages.dev) rather than a legitimate corporate domain, which is highly unusual for a major gambling brand.; The URL uses keywords like 'login' and 'vip' alongside a well-known brand name to create a deceptive link aimed at harvesting user credentials or financial information. | Phishing |
The Muninn extension checks against Yggdrasil plus AI analysis that can catch threats not in the database yet. Submitting URLs requires logging in.