ledger-live-login-swet[.]pages[.]dev

This domain, ledger-live-login-swet.pages.dev, was registered on September 08, 2025 through Cloudflare, Inc. and remains active as of July 12, 2026. It is classified as a high‑risk brand‑impersonation operation targeting Ledger users. The site presents a Cloudflare‑generated page titled “Worker threw exception | ledger-live-login-swet.pages.dev | Cloudflare”, which suggests a misconfiguration or intentional error page rather than a legitimate login interface. Technical analysis shows the domain resolves to IP 172.66.45.41, which belongs to AS13335 Cloudflare, Inc., located in the United States. The server presents a Google Trust Services / WE1 SSL certificate, enforces HTTP Strict Transport Security, and supports HTTP/3, indicating the use of Cloudflare’s edge services. Nameservers are jade.ns.cloudflare.com and ganz.ns.cloudflare.com. The HTTP response code is 500, confirming the worker exception page. Gridinsoft assigns a trust score of 0 / 100, and VirusTotal reports that 11 of 95 security vendors flag the domain as malicious. The domain is currently listed on one public blocklist and has been blocked by the PhishDestroy service. Publicly available evidence does not include a captured landing page or screenshot of the credential‑collection interface, so the exact content and attack flow remain unverified. The page title alone confirms the presence of a Cloudflare worker error, which may be used to hide malicious scripts or redirect victims. No additional malware kits, payload hashes, or command‑and‑control infrastructure have been observed. Defenders should add ledger-live-login-swet.pages.dev to URL filtering and DNS blocklists, monitor outbound traffic to the associated Cloudflare IP range, and educate Ledger users about unsolicited login prompts that reference this domain. Continuous re‑scanning of the domain with threat‑intelligence platforms is recommended to detect any changes in hosting, certificate, or payload delivery.