Yggdrasil

The login page is hosted on Cloudflare's R2 object storage (r2.dev) rather than an official AT&T domain, which is a common indicator of a phishing site. +1 more

The domain name 'sshimran-2026flavour.com' is unrelated to the official Smirnoff brand, which is a common indicator of a phishing attempt. +1 more

The URL contains a misspelling of the brand name ('ledge' instead of 'ledger') and is hosted on a free subdomain (pages.dev), which is a common tactic for phishing sites. +1 more

The domain 'lldgerr-live.pages.dev' contains a blatant misspelling of the 'Ledger' brand, which is a common typosquatting technique used in phishing. +1 more

The URL uses typosquatting by misspelling 'ledger' as 'ledjr' to deceive users into thinking it is the official site. +1 more

The domain 'trzr-brige.pages.dev' uses a deliberate misspelling of 'bridge' and a common abbreviation for Trezor, hosted on a free platform (pages.dev) instead of the official trezor.io domain. +1 more

The URL uses a typo-squatted subdomain 'trezo-io' which is a clear attempt to mimic the official 'trezor.io' brand while hosted on a generic Cloudflare Pages domain. +1 more

The URL uses the free hosting service pages.dev and incorporates a misspelled version of the Uphold brand name ('uphldapp'), which is a high-confidence indicator of a phishing or social engineering attempt. +1 more

The URL contains a clear typosquatting attempt with 'leedger' instead of 'ledger' to deceive users. +1 more

The URL uses a typo-squatted domain name ('ledgar' instead of 'ledger') which is a definitive indicator of brand impersonation. +1 more

The URL uses multiple misspellings of the brand and product names ('leedgers' and 'walet'), a classic hallmark of typosquatting phishing attacks. +1 more

The URL uses a typosquatted subdomain 'ldgr' (mimicking the Ledger brand) hosted on a free platform (pages.dev) rather than the official 'ledger.com' domain. +1 more