home-leger-desktop[.]framer[.]ai

This domain, home-leger-desktop.framer.ai, is identified as a brand impersonation threat targeting Ledger, a hardware wallet provider. The site mimics the official Ledger Live Desktop software, presenting itself as "Ledger Live Desktop: Official Software for Secure Hardware Wallet Management." Analysis indicates no direct evidence of a crypto drainer kit embedded in the visible page source, though the impersonation framework suggests potential credential harvesting or malicious payload delivery upon interaction. The domain aligns with tactics used to deceive users into divulging recovery phrases or installing compromised software updates. Infrastructure analysis reveals the following technical indicators: the domain was created on January 06, 2018, and is registered through CSC Corporate Domains, Inc. It resolves to IP address 35.71.142.77, hosted on Amazon.com, Inc. (AS16509) infrastructure in the United States. The SSL certificate is issued by Let's Encrypt (serial number E8). VirusTotal reports 9 out of 95 security vendors flagging the domain as malicious. The domain appears on five security blocklists, including PhishDestroy, Polkadot, Enkrypt, Codeesura, and PhishingDB. No Google Safe Browsing (GSB) detection is explicitly noted, though the volume of third-party detections suggests high confidence in malicious classification. The domain is currently offline, likely following takedown actions by hosting providers or registrars in response to abuse reports. While the immediate threat is mitigated, residual risk persists through cached pages, social engineering campaigns, or redirected infrastructure. Users who accessed the site prior to takedown may remain vulnerable to follow-on attacks, including phishing emails or secondary payloads. To mitigate risk, affected users should revoke any connected wallet sessions, rotate credentials, and verify software authenticity exclusively through Ledger’s official channels. Monitoring for unauthorized transactions and reviewing installed applications for anomalies is recommended.