ledger-live-wallet-swt[.]pages[.]dev

On 23 July 2026 analysts observed that ledger-live-wallet-swt.pages.dev, a sub‑domain hosted on Cloudflare’s pages.dev platform, was serving a page titled “Ledger Live Desktop – Manage Crypto Safely on PC & Mac”. The page title directly references Ledger’s official product, indicating a brand‑impersonation attempt aimed at cryptocurrency users. The domain was registered on 21 February 2026 through Cloudflare, Inc., and resolves to IP address 172.66.47.6, which belongs to AS13335 (Cloudflare, Inc.) located in the United States. TLS termination is performed by Google Trust Services (certificate authority WE1), and the site employed HSTS and HTTP/3, suggesting an attempt to appear legitimate.

An HTTP request returned a 403 status code before the site was taken offline, confirming that the content is no longer reachable. VirusTotal analysis recorded 14 of 93 AV engines flagging the domain as malicious, and the Gridinsoft trust score was 0 / 100, reinforcing the malicious classification. The domain appears on a single security blocklist and has been actively blocked by PhishDestroy. The identified scam type is “Crypto Scam”, consistent with the Ledger brand impersonation.

No additional safe‑browsing or OTX entries were available at the time of writing. Defensive recommendations include adding ledger-live-wallet-swt.pages.dev and its resolving IP 172.66.47.6 to existing URL and IP blocklists, monitoring Cloudflare‑hosted sub‑domains that use Ledger‑related keywords in page titles, and enforcing DNS filtering for the pages.dev suffix. Because the infrastructure relies on Cloudflare’s shared hosting, further scrutiny of other Cloudflare‑registered sub‑domains with similar naming patterns may help pre‑empt related campaigns. Continuous re‑scanning through multi‑vendor services is advised to capture any future re‑activations.