started-ledgrlive[.]framer[.]ai

The domain started-ledgrlive.framer.ai was observed hosting a page titled “Ledger Live: Download Crypto Wallet App”. The site leveraged Framer Sites, React, HSTS, and HTTP/3, and was served over a Let’s Encrypt certificate (E8). DNS resolution pointed to IP 52.223.52.2, an address owned by Amazon.com, Inc. (AS16509) and geolocated to the United States. The domain’s authoritative nameservers are ns-114.awsdns-14.com, ns-1198.awsdns-21.org, ns-1902.awsdns-45.co.uk, and ns-635.awsdns, all belonging to AWS DNS infrastructure.

Registration data shows the domain was created on 6 January 2018 and was registered through CSC Corporate Domains, Inc. The site was classified as a crypto‑related scam impersonating the Ledger brand. It was blocked by PhishDestroy and appears on one security blocklist. VirusTotal recorded scans from 95 vendors, none of which flagged the domain at the time of scanning; this lack of detections does not constitute evidence of safety. An HTTP request returned a 404 status, and the domain is currently taken offline.

Because the page is no longer accessible, detailed content analysis is limited to the metadata provided. Defenders should treat the domain as malicious, add the IP address 52.223.52.2 to network deny lists, and ensure that any inbound or outbound traffic to the domain or its associated AWS nameservers is monitored or blocked. Continuous observation of the registrar CSC Corporate Domains, Inc. for future registrations that reuse similar naming patterns is advisable. Additionally, security tooling should be updated to flag any future attempts to serve Ledger‑related content from this infrastructure, and incident response teams should be prepared to handle potential credential‑ harvesting attempts that may have leveraged the impersonated brand.