Phishing alert: genuine-swan-a712a3.netlify.app impersonates Ledger crypto wallet

What happened

The phishing-alert account @TheThreatWire posted on X on 13 November 2026 (Phishing Alert #142) that hxxps://genuine-swan-a712a3.netlify.app/ is a phishing page impersonating Ledger, the French maker of cryptocurrency hardware wallets and the Ledger Live app. The domain also appears on the Phishing Army extended blocklist, a public phishing domain blocklist. netlify.app is a shared hosting domain; only this subdomain is reported here, and Netlify and Ledger are not the operators. Never type your Ledger recovery phrase into any website or app; Ledger will never ask for it. Source: https://x.com/TheThreatWire/status/2121114700150952315

How the scam works

Crypto phishing and draining sites ask you to connect a wallet, sign a transaction, 'claim' a token, or paste a recovery phrase. Once you approve the request, the operator can empty the wallet. Address-poisoning works differently: the operator sends dust or zero-value transfers from a look-alike address so that, later, a hurried copy-paste from the transaction history goes to them instead of to the address you meant. Always check every character of an address, and never connect a wallet or enter a seed phrase on a site you reached from a message, a pop-up or a look-alike URL. Official wallet and exchange brands named in a lure are not involved.

If a message, a page or a caller creates urgency about money, a login or a legal threat, pause and check the claim through a contact method you already trust. Keep screenshots, reference numbers and the exact addresses or phone numbers you were given, and tell your bank early if money has already left the account. Official brands and authorised firms named in a lure are not involved unless a primary source says otherwise.

Source

Source: https://x.com/TheThreatWire/status/2121114700150952315