ledger-login-swts[.]pages[.]dev

This domain, ledger-login-swts.pages.dev, is flagged as a brand impersonation threat targeting Ledger, a cryptocurrency hardware wallet provider. Analysis indicates the domain was registered on February 21, 2026, through Cloudflare, Inc., and was taken offline by July 23, 2026, following detection. Infrastructure analysis reveals the domain resolved to IP 172.66.47.20, hosted on Cloudflare's network (AS13335) in the US, with nameservers lucy.ns.cloudflare.com and tate.ns.cloudflare.com. The site employed HTTP/3 and HSTS, alongside a Google Trust Services SSL certificate (WE1), suggesting an attempt to appear legitimate.

At the time of assessment, the domain returned an HTTP 403 status, and Cloudflare's page title explicitly labeled it as a 'Suspected phishing site.' Security vendor detections include 10 of 93 engines on VirusTotal flagging the domain, and it appears on one security blocklist, specifically PhishDestroy. Gridinsoft assigned a trust score of 0/100, reinforcing its classification as a crypto scam. While the domain is currently offline, defenders should treat any prior connections or cached references as high-risk indicators. The use of Cloudflare Pages infrastructure is notable, as it provides free hosting and SSL, which threat actors frequently exploit for phishing campaigns.

No evidence of a specific phishing kit or additional malicious payloads is present in the available data, but the domain's structure and naming convention align with typical Ledger impersonation tactics. Defenders are advised to block the domain and its associated IP at the network level, monitor for related subdomains or newly registered lookalike domains, and review logs for any prior interactions with this domain. Given the elevated risk level and the sensitive nature of cryptocurrency wallet credentials, organizations handling crypto-related assets should prioritize this domain in their threat intelligence feeds and incident response protocols.