connect-desktop-ledgger[.]framer[.]ai

Analysis indicates that the domain connect-desktop-ledgger.framer.ai is actively used for brand impersonation against Ledger, presenting a page title of “Ledger Live Desktop® – Trusted Digital Asset Dashboard.” The domain was registered through CSC Corporate Domains, Inc. on 6 January 2018 and resolves to the Amazon‑owned IP address 52.223.52.2, ASN 16509, located in the United States. DNS records show four AWS nameservers (ns‑114.awsdns‑14.com, ns‑1198.awsdns‑21.org, ns‑1902.awsdns‑45.co.uk, ns‑635.awsdns). The site served an HTTPS certificate from Let’s Encrypt (E8) and advertised security features such as HSTS and HTTP/3, while technology fingerprints identified Framer Sites and React. A HTTP request returned a 404 status, and the domain has been taken offline. Independent security services have already flagged the site: PhishDestroy listed it as blocked, and VirusTotal reported a single positive detection out of 95 scanners.

The domain appears on one additional security blocklist, confirming that it has been recognized as malicious by at least two distinct threat‑intelligence feeds. The scam type is identified as a crypto scam, consistent with the Ledger brand focus. Uncertainty remains regarding the current content of the site, as the 404 response and offline status limit direct observation of any credential‑harvesting pages. No public Safe Browsing or Open Threat Exchange entries are provided, and no further contextual indicators such as phishing kits or command‑and‑control infrastructure are known.

Defenders should immediately add connect‑desktop‑ledgger.framer.ai to URL filtering, web‑proxy, and endpoint allow‑list exclusions. Network monitoring rules should block outbound connections to 52.223.52.2 and the associated AWS nameservers. Email security gateways should treat any messages referencing the Ledger Live Desktop title as suspicious.