ledgr-live-strt[.]framer[.]media

This domain, ledgr-live-strt.framer.media, is flagged as a high-risk brand impersonation threat specifically targeting Ledger, a hardware wallet provider. Analysis indicates the site mimics the Ledger Live application interface, presenting itself as an "Official-Style App & Hardware Wallet Overview" to deceive users into entering sensitive credentials or downloading malicious software. No direct evidence of a cryptocurrency drainer kit was observed, but the domain’s structure and content align with credential harvesting tactics commonly used in phishing campaigns against cryptocurrency users.

Infrastructure analysis reveals the domain was registered on June 12, 2024, through CSC Corporate Domains, Inc. It resolves to the IP address 31.43.161.6 and employs a Let’s Encrypt SSL certificate, which is frequently abused by threat actors to lend false legitimacy. VirusTotal reports 15 out of 95 security vendors flagging the domain as malicious. The domain appears on three security blocklists and is actively blocked by PhishDestroy, PhishingArmy, and OISD. Gridinsoft assigns a trust score of 0/100, further confirming its malicious classification. Technologies detected include Framer Sites, React, HSTS, and HTTP/3, which are consistent with modern phishing infrastructure designed to evade detection and appear authentic.

As of the latest assessment, ledgr-live-strt.framer.media has been taken offline, likely due to enforcement actions by hosting providers or domain registrars. However, residual risk remains, as threat actors may re-deploy the phishing kit under a new domain or IP address. Users who interacted with the site should assume credential compromise and take immediate action, including revoking access to any connected wallets, rotating passwords, and monitoring for unauthorized transactions. Organizations should update blocklists to include this domain and its associated indicators of compromise (IOCs) to prevent future access attempts.