connect-app-ledgrr[.]framer[.]ai

Analysis of connect-app-ledgrr.framer.ai shows a domain registered on 2018-01-06 through CSC Corporate Domains, Inc. The authoritative name servers are ns-114.awsdns-14.com, ns-1198.awsdns-21.org, ns-1902.awsdns-45.co.uk and ns-635.awsdns, indicating use of Amazon Route 53 DNS. The host resolves to 35.71.142.77, an address owned by AS16509 Amazon.com, Inc. in the United States. The site served a TLS certificate from Let’s Encrypt (E8) and the observed HTTP response was 404, confirming that the content is currently unavailable. The page title returned by the server was “Ledger Live App® | Official Site — Ledger Mobile,” directly referencing Ledger’s product line, and the threat classification is listed as a “Crypto Scam” with brand impersonation of Ledger. The infrastructure stack includes Framer Sites, React, HSTS and HTTP/3, which are typical of modern web applications but do not mitigate the malicious intent.

The domain appears on a single security blocklist and is specifically blocked by PhishDestroy. VirusTotal recorded a single detection out of 95 scanners, reinforcing the presence of at least one security vendor flagging the domain. No additional public intelligence such as OTX or Safe Browsing entries is supplied. The combination of brand‑specific page title, crypto‑related scam type, and the single vendor detection suggests a targeted attempt to lure Ledger users, possibly to harvest credentials or direct them to malicious cryptocurrency services.

Because the site is offline, immediate traffic is blocked, yet the domain could be re‑activated or used in future campaigns. Defenders should continue to monitor DNS queries for the listed name servers and the IP address 35.71.142.77, enforce URL filtering for the full domain string, and add the domain to internal blocklists.