livestart-ldgre[.]framer[.]media

This domain is flagged as a high-risk brand impersonation threat specifically targeting Ledger, a cryptocurrency hardware wallet provider. Analysis indicates the site was designed to deceive users into believing they are interacting with an official Ledger Live initialization page, potentially facilitating unauthorized access to wallet credentials or seed phrases. The threat type aligns with known crypto drainer tactics, where victims are tricked into executing malicious transactions or disclosing sensitive recovery information. Infrastructure analysis reveals the domain livestart-ldgre.framer.media was registered through CSC Corporate Domains, Inc. and resolves to the IP address 31.43.161.6. It is detected by 20 out of 95 security vendors on VirusTotal, with active blocks from PhishDestroy, PhishingArmy, and OISD, totaling three security blocklists. The site employed technologies including Framer Sites, React, HSTS, and HTTP/3, and used a Let's Encrypt SSL certificate. The page title, "Ledger Live App — Initialize™ Your Ledger Device | Ledger®," closely mimics official Ledger branding to enhance credibility. Mitigation steps for this threat type include immediate blacklisting of the domain and IP in enterprise security gateways. Organizations should alert users to verify domain authenticity before entering credentials or seed phrases, particularly for cryptocurrency-related services. Security teams are advised to monitor for similar impersonation patterns, such as domains using "livestart," "ledger," or "live" in combination with third-party hosting platforms like Framer. If the domain reappears, network-level blocking and takedown requests should be prioritized to prevent further exploitation.