desktop-ledgr[.]framer[.]ai

Analysis of desktop-ledgr.framer.ai, observed on July 25, 2026, shows a brand‑impersonation infrastructure that targets Ledger users. The site resolves to the Amazon Web Services address 35.71.142.77, which is assigned to AS16509 (Amazon.com, Inc.) and geolocated in the United States. TLS is provided by a Let’s Encrypt certificate (E8), indicating a valid but freely issued certificate. An HTTP request returns a 404 status, and the page title reported by crawlers is "Official Ledger Live Desktop Download | Ledger.com/Start," matching the Ledger brand and confirming the impersonation intent.

Technical fingerprints list Framer Sites, React, HSTS, and HTTP/3, suggesting the use of a modern front‑end stack hosted on the framer.ai subdomain. The domain is registered through CSC Corporate Domains, Inc., and its authoritative name servers are ns-1902.awsdns-45.co.uk, ns-635.awsdns-15.net, ns-1198.awsdns-21.org, among others. Reputation data shows the domain appears on a single security blocklist and has been actively blocked by PhishDestroy. VirusTotal analysis reports five detections out of ninety‑three scanning engines, reinforcing the malicious classification.

The observed characteristics—Ledger brand reference, crypto‑scam labeling, and the use of a legitimate‑looking download page—indicate a credential‑stealing or malware‑distribution campaign aimed at Ledger Live users. Defenders should add desktop-ledgr.framer.ai to URL filtering and DNS block lists, monitor traffic to the associated AWS IP, and treat any connections to the domain as hostile. Continuous re‑scanning of the domain and its IP range is recommended to capture any re‑activation, and incident response teams should alert end‑users to the fraudulent Ledger Live download page.