en-desktop-ledge[.]framer[.]ai

Analysis of en-desktop-ledge.framer.ai shows that the domain was created on 4 April 2023 through CSC Corporate Domains, Inc. and is hosted on Amazon’s infrastructure (ASN 16509) at the IPv4 address 35.71.142.77, which resolves to a United States location. The site presents a TLS certificate issued by Let’s Encrypt (E8) and the HTTP response is a 404 with the page title “Site Not Found | Framer”. Detected technologies include the Framer Sites platform, React, HSTS and HTTP/3, indicating a modern web stack. The authoritative name servers are ns‑114.awsdns‑14.com, ns‑1198.awsdns‑21.org, ns‑1902.awsdns‑45.co.uk and ns‑635.awsdns, all belonging to Amazon’s DNS service.

The domain is listed on a single security blocklist and has been explicitly blocked by PhishDestroy. VirusTotal analysis recorded a single positive detection out of 93 scanning engines, confirming that at least one vendor has identified malicious behavior associated with the domain. No additional public intelligence, such as Safe Browsing or OTX entries, is currently available. The site appears to be taken offline, as indicated by the 404 status and the “Site Not Found” title, and there is no publicly observable phishing landing page to assess the exact lure or credential‑harvesting method.

Given the combination of a recent creation date, hosting on a cloud provider, a valid TLS certificate, detection by a dedicated anti‑phishing feed, and a positive vendor flag, the domain should be treated as a confirmed phishing infrastructure. Defenders should add the domain and its resolved IP address to network‑level blocklists, enforce DNS sinkholing for the name, and monitor the ASN for any future re‑use of the same host. Continuous re‑resolution checks are advisable because the site could be re‑activated under the same domain or a sibling subdomain. Logging any outbound connections to the IP and correlating with user reports will aid in early detection should the phishing campaign resume.