ledgerswap[.]fun

Analysis of the domain ledgerswap.fun confirms its classification as an active crypto drainer phishing site, as of July 29, 2026. The domain was registered on July 17, 2026, through Fewmoretaps OU d/b/a Trustname.com, a registrar frequently associated with high-risk domains. Infrastructure analysis reveals the domain resolves to the IP address 186.2.175.35, with nameservers configured as ares.trustname.com, ns1.anycastdns.cz, ns2.anycastdns.cz, and zeus.trustname.com, indicating a reliance on hosting providers commonly utilized for malicious campaigns. Detection data from VirusTotal shows that 3 out of 91 security vendors have flagged this domain, while it appears on at least one security blocklist and is actively blocked by PhishDestroy.

The domain remains operational, with no indications of takedown or mitigation efforts as of the report date. The threat type is explicitly identified as a crypto drainer, a specialized form of phishing designed to siphon cryptocurrency from victims' wallets. While the exact content and targeting mechanisms of the site are not yet analyzed, the available evidence—including registrar details, hosting infrastructure, and detection counts—supports its classification as a high-risk domain.

Defenders are advised to treat this domain as malicious and implement blocking measures at the network and endpoint levels. Organizations should monitor for connections to 186.2.175.35 and associated nameservers, as these may indicate compromise or attempted exploitation. Further investigation into the domain's payload and victim targeting is recommended to assess the full scope of the campaign.