us-ledgredesktop[.]framer[.]ai

us-ledgredesktop.framer.ai was observed as part of a high‑risk brand‑impersonation campaign targeting Ledger users. The domain was registered on 06 January 2018 through CSC Corporate Domains, Inc. and is hosted on Amazon Web Services (AS16509) in the United States, resolving to 35.71.142.77. The site served content built with Framer Sites and React, enforced HSTS and HTTP/3, and presented a TLS certificate issued by Let’s Encrypt (E8). The HTTP response returned a 404 status code and the page title captured by crawlers reads “Ledgér Live Desktop® | Download & Install — Official Guide,” which explicitly references the Ledger brand.

Multiple security‑vendor blocklists, including PhishDestroy, Polkadot, Enkrypt and Codeesura, have flagged the domain, and it appears on four additional blocklists. VirusTotal analysis shows that 10 of 95 scanners marked the site as malicious. The domain’s nameservers are ns-114.awsdns-14.com, ns-1198.awsdns-21.org, ns-1902.awsdns-45.co.uk and ns-635.awsdns. The infrastructure indicates a typical crypto‑scam deployment that aims to lure victims into downloading counterfeit Ledger desktop software.

At the time of reporting the site is taken offline, but the persisted DNS records and historical indicators suggest that the infrastructure could be re‑used for future impersonation attempts. Defenders should add the domain and its associated IP address to deny‑list rules, monitor the listed nameservers for rapid re‑registration, and ensure that endpoint protection solutions are updated to recognize the observed SSL fingerprint and the specific page title pattern. Continuous threat‑intel feeds should be consulted for any resurgence, and any internal attempts to access the URL should be logged and investigated as potential credential‑theft incidents.