en-dekstop[.]framer[.]ai

The domain en-dekstop.framer.ai is flagged as a brand‑impersonation vector targeting Ledger users. Registration records show the domain was created on 06 January 2018 through CSC Corporate Domains, Inc., and it resolves to the Amazon‑owned IP address 52.223.52.2, associated with ASN 16509 in the United States. DNS resolution is served by four AWS Route 53 name servers (ns‑114.awsdns‑14.com, ns‑1198.awsdns‑21.org, ns‑1902.awsdns‑45.co.uk, ns‑635.awsdns). The site presents a TLS certificate issued by Let’s Encrypt (identifier E8) and enforces HSTS while supporting HTTP/3, indicating a modern web stack.

Automated probing returned an HTTP 404 status, and the site is currently offline, limiting direct content analysis. However, the page title retrieved from prior captures reads “Ledger Live | Secure Desktop App for Managing Crypto,” which aligns with the declared brand target and the scam type listed as a crypto scam. The domain appears on a single security blocklist and is explicitly blocked by PhishDestroy. VirusTotal reports a single detection out of 95 scanning engines, reinforcing the suspicion of malicious intent.

Infrastructure clues—AWS hosting, a generic Let’s Encrypt certificate, and a misleading page title—are consistent with a credential‑harvesting campaign masquerading as Ledger’s desktop client. Defenders should immediately add en-dekstop.framer.ai to network‑level blocklists, monitor DNS queries for the associated AWS name servers, and flag any authentication attempts made to Ledger services originating from this address. Ongoing surveillance of the domain’s registration and hosting details is advised, as the offline status may change if the operators reactivate the site.