official-desktop-ledgger[.]framer[.]ai

The domain official-desktop-ledgger.framer.ai was registered on January 06, 2018 through CSC Corporate Domains, Inc. and resolves to the Amazon Web Services address 52.223.52.2, belonging to AS16509 Amazon.com, Inc. The hosting location is the United States. DNS resolution is provided by four Amazon name servers (ns-114.awsdns-14.com, ns-1198.awsdns-21.org, ns-1902.awsdns-45.co.uk, ns-635.awsdns). An SSL certificate issued by Let’s Encrypt (E8) secures the site, and the server advertises HSTS and HTTP/3 support. Technology fingerprinting identifies the use of Framer Sites and the React framework.

The HTTP response for the root URL is a 404 status, and the domain is currently taken offline. The page title returned by the server is "Ledger Live Desktop® – Smart Crypto Tracking & Security," indicating an attempt to impersonate the Ledger brand. The infrastructure has been classified as a crypto‑related scam and appears on a single security blocklist, PhishDestroy. VirusTotal analysis shows scans from 95 vendors with no detections, though the absence of flags does not constitute a safety guarantee.

No additional public threat‑intel sources (e.g., OTX, Safe Browsing) are cited in the available data. Defenders should continue to block the domain at perimeter filters, monitor for any re‑activation, and consider adding the domain to internal deny lists. Because the site is offline, dynamic analysis is not possible; however, the combination of brand‑specific page title, use of a reputable CDN, and the presence on a phishing blocklist suggests a deliberate impersonation campaign targeting Ledger users. Organizations that rely on Ledger services should educate users about the risk of unsolicited links and reinforce verification of legitimate Ledger URLs before entering credentials or installing software.