live-endesktop[.]framer[.]ai

The domain live-endesktop.framer.ai has been identified as a brand impersonation threat targeting Ledger, a cryptocurrency hardware wallet provider. Analysis indicates the domain is designed to mimic the official Ledger Live Desktop application, a portfolio and asset management platform for cryptocurrency users. As of the latest assessment, the domain has been taken offline, though prior activity suggests it was actively used in a phishing campaign to deceive users into disclosing sensitive credentials or installing malicious software. Infrastructure analysis reveals the domain was created on January 6, 2018, and is registered through CSC Corporate Domains, Inc. It resolves to the IP address 35.71.142.77, hosted on infrastructure belonging to Amazon.com, Inc. (AS16509) in the United States. Detection metrics indicate the domain was flagged by 9 out of 95 security vendors on VirusTotal, and it appears on at least one security blocklist. The SSL certificate is issued by Let's Encrypt (serial number E8), a common choice for both legitimate and malicious domains due to its accessibility. The page title, "Ledger Live Desktop® | Official Portfolio & Asset Manager," directly impersonates the legitimate Ledger Live application, increasing the likelihood of successful social engineering attacks. The current status of the domain is offline, reducing immediate risk to users. However, the infrastructure remains a potential vector for future malicious activity. Users and organizations are advised to block the domain and associated IP address (35.71.142.77) at the network level. Cryptocurrency holders should verify the authenticity of any Ledger-related communications by accessing the official website directly and avoiding links from unsolicited messages. Security teams are recommended to monitor for similar impersonation domains registered through CSC Corporate Domains, particularly those leveraging Let's Encrypt certificates and Amazon-hosted infrastructure. Proactive threat hunting for related indicators of compromise is advised to mitigate residual risk.