homeweb[.]framer[.]media

The domain homeweb.framer.media was observed hosting a Ledger brand impersonation page titled "Ledger.com/Start® | Getting started — Ledger Support". The site resolves to the Amazon‑owned IP address 35.71.142.77, registered to AS16509 in the United States. DNS resolution is served by four AWS Route 53 name servers (ns-97.awsdns-12.com, ns-1854.awsdns-39.co.uk, ns-535.awsdns-02.net, ns-1…). The TLS certificate is issued by Let’s Encrypt (E7), indicating a recently‑generated HTTPS endpoint. HTTP requests return a 404 status, suggesting the malicious content may be served dynamically or has been removed.

The registrar listed is CSC Corporate Domains, Inc., and the hosting stack includes Framer Sites, React, HSTS and HTTP/3, which aligns with the use of modern web‑app frameworks for phishing campaigns. VirusTotal reports 12 of 93 security scanners flagging the domain, and it appears on a single external blocklist. PhishDestroy also confirms the domain as blocked. The campaign is classified as a crypto‑related scam, leveraging Ledger’s brand to lure victims, likely to solicit cryptocurrency credentials or payments.

The current operational status is offline, which may indicate takedown or temporary suspension. Defenders should add the IP 35.71.142.77 and the full domain to network‑level blocklists, monitor for any re‑use of the same name‑server set or certificate fingerprint, and review any outbound traffic to Let’s Encrypt‑issued sites that reference Ledger‑related URLs. Continuous observation of the registrar CSC Corporate Domains, Inc. for new registrations mimicking Ledger, and periodic re‑scanning on VirusTotal, are recommended to catch potential re‑emergence. The evidence presented is limited to the listed intelligence; no additional content or login page details have been disclosed.