ledgerlives[.]framer[.]ai

Analysis of ledgerlives.framer.ai shows multiple indicators that align with a Ledger brand impersonation campaign targeting cryptocurrency users. The domain resolves to the IP address 52.223.52.2, which is owned by Amazon Web Services (ASN 16509) and geolocated to the United States. Registration data indicates the domain was created on January 06 2018 through CSC Corporate Domains, Inc., a registrar commonly used for bulk registrations. The site presented an SSL certificate issued by Let’s Encrypt (certificate identifier E8), confirming that TLS is enabled but offering no additional trust beyond standard domain validation. Technical fingerprinting reveals the use of Framer Sites and a React‑based front‑end, with HTTP/3 support and HTTP Strict Transport Security (HSTS) enforced.

When accessed, the HTTP response returned a 404 status code, and the page title returned by the server is "Official Site® | Ledger Live | Getting started," directly referencing Ledger’s official product naming. VirusTotal analysis recorded a single detection out of 95 scanning engines, and the domain is listed on one external security blocklist. PhishDestroy has also taken the domain offline, and the current status is reported as offline. The combination of a legitimate‑looking page title, the use of Ledger’s brand name, and the classification of the campaign as a crypto scam suggests the site was intended to lure Ledger users into disclosing credentials or private keys.

However, the lack of publicly available content beyond the 404 response limits insight into the exact phishing flow or payload. Defenders should continue to block the domain at network perimeters, monitor DNS queries for the associated IP address, and flag any attempts to resolve ledgerlives.framer.ai. Organizations using Ledger hardware wallets should reinforce user awareness that legitimate Ledger services are hosted on ledger.com and its subdomains, and that any request to a framer.ai subdomain is anomalous.