version-desktop-ledgre[.]framer[.]ai

Analysis of version-desktop-ledgre.framer.ai, a domain created on April 04, 2023 and currently taken offline, reveals infrastructure consistent with a brand‑impersonation operation targeting Ledger users. The domain is registered through CSC Corporate Domains, Inc. and resolves to the Amazon Web Services IP address 35.71.142.77 (AS16509, United States). DNS resolution is served by four AWS Route 53 name servers (ns-114.awsdns-14.com, ns-1198.awsdns-21.org, ns-1902.awsdns-45.co.uk, ns-635.awsdns). The site hosts a Framer site built with React, enforces HTTP Strict Transport Security, and supports HTTP/3, indicating a modern web stack.

An SSL certificate issued by Let’s Encrypt (identifier E8) is present, and an HTTP request returns a 404 status with the page title "Site Not Found | Framer," suggesting the original content has been removed or the site was deliberately taken down. The domain is listed on one security blocklist and has been flagged by PhishDestroy as a crypto‑related scam. VirusTotal scanned the domain with 93 vendor engines and reported no detections, though the absence of detections does not guarantee safety. No additional public threat intelligence, such as Google Safe Browsing or OTX alerts, is currently associated with the domain.

Defenders should continue to monitor the domain for re‑activation, block the IP address 35.71.142.77 at network perimeters, and add the domain to URL filtering policies that target Ledger‑related impersonation attempts. Because the site is offline, direct forensic collection is limited; however, the registration details, hosting environment, and observed technologies provide sufficient indicators to classify the domain as a Ledger brand impersonation scam. Organizations should educate users about unsolicited Ledger‑related communications and encourage verification of URLs before entering credentials or cryptocurrency information.