ledger-com-start-swts[.]pages[.]dev

The domain ledger-com-start-swts.pages.dev is identified as a brand‑impersonation site targeting Ledger and is classified as a crypto‑scam. It was registered through Cloudflare, Inc. on February 21, 2026 and uses the Cloudflare nameservers arya.ns.cloudflare.com and jaxson.ns.cloudflare.com. DNS resolution points to the Cloudflare edge address 172.66.44.98, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. The site presents a valid HTTPS endpoint secured by a Google Trust Services / WE1 certificate, and the host enforces HSTS and HTTP/3, indicating modern TLS configuration.

An HTTP request returns a 403 status code and the Cloudflare‑generated page title reads “Suspected phishing site | Cloudflare,” confirming that the service has been flagged and taken offline by the provider. Reputation metrics are extremely poor: Gridinsoft assigns a trust score of 0 / 100, and the domain appears on one external security blocklist, specifically being blocked by PhishDestroy. VirusTotal analysis shows that nine of ninety‑three scanning engines flag the domain, reinforcing the malicious assessment.

No additional content or payload details are publicly disclosed beyond the block page title, so the exact phishing or malware mechanisms remain unknown. Defenders should immediately block the domain at DNS and network layers, add it to sinkhole lists, and ensure that intrusion‑prevention and web‑filtering solutions are updated to reflect this indicator. Reporting to Cloudflare’s abuse team and to Ledger’s brand‑protection contacts is advised to aid takedown and attribution efforts.