io-hyperswap-airdrop[.]pages[.]dev

The domain io-hyperswap-airdrop.pages.dev poses a significant threat by impersonating the brand Ledger. This malicious site employs deceptive tactics to lure users into believing they are participating in a legitimate airdrop, potentially leading to credential theft or financial loss.

Analysis reveals that this domain was created on October 31, 2025, and is registered through Cloudflare, Inc. It appears on 3 recognized security blocklists, including PhishDestroy, MetaMask, and SEAL. Current data from VirusTotal indicates that 2 out of 95 security vendors have flagged this domain, suggesting a moderate level of awareness among security tools. The domain resolves to the IP address 172.66.47.158, which is located in the US and operated by AS13335 Cloudflare, Inc. The SSL certificate is issued by Google Trust Services, indicating an attempt to legitimize the fraudulent site.

Users who may have visited the site are advised to immediately cease any interactions with the domain and monitor their financial accounts for any unauthorized transactions. It is critical to change any credentials potentially compromised on this site and employ multifactor authentication where possible. Security tools should be updated and used to scan for any potential malware that may have been downloaded unknowingly during the visit.