ledgerswiss[.]com

Analysis of the domain ledgerswiss.com indicates active brand impersonation targeting Ledger, a cryptocurrency hardware wallet provider. The domain was registered on November 15, 2023, through GoDaddy.com, LLC, and resolves to the IP address 172.64.153.104. Infrastructure analysis reveals the use of Cloudflare, HSTS, Google Tag Manager, and HTTP/3, suggesting an attempt to mimic legitimate security and performance features. The SSL certificate is issued by GoDaddy.com, which aligns with the domain registrar but does not mitigate the risk of impersonation. The page title, 'Ledger Crypto Wallet - Security for DeFi & Web3,' directly references Ledger’s branding and core services, reinforcing the likelihood of brand impersonation. As of July 12, 2026, the domain remains active and is flagged by two security blocklists: PhishDestroy and BLP-Malware. VirusTotal reports that 2 of 95 security vendors detect the domain as malicious, while AlienVault OTX includes it in 23 threat intelligence pulses, further corroborating its association with phishing activity. Defenders should treat this domain as high-risk due to its confirmed presence on multiple blocklists, alignment with known phishing infrastructure, and direct impersonation of a high-value cryptocurrency brand. The domain’s creation date, while not recent, does not diminish its current threat status, as phishing domains often remain dormant before activation. No evidence suggests the site has been taken down or mitigated, and organizations should prioritize blocking or monitoring traffic to this domain to prevent potential credential theft or financial fraud.