ldeger-comstart[.]framer[.]ai

The domain ldeger-comstart.framer.ai was observed hosting a site that mimics Ledger's branding. The page title "Ledger.com Start – Activate and Protect Your Crypto Assets" directly references Ledger, confirming the intent to impersonate the hardware‑wallet provider. The site was built on Framer Sites and React, with HSTS and HTTP/3 enabled, and served over a Let’s Encrypt certificate (CN=E8). DNS resolution points to 52.223.52.2, an Amazon Web Services host (AS16509, United States).

Nameservers are ns-114.awsdns-14.com, ns-1198.awsdns-21.org, ns-1902.awsdns-45.co.uk, and ns-635.awsdns, all belonging to AWS DNS infrastructure. The domain was registered on April 04, 2023 through CSC Corporate Domains, Inc. VirusTotal reports five of ninety‑three scanning engines flagging the host, and the domain appears on a single security blocklist. PhishDestroy has taken the domain offline, and the current HTTP response is 404, indicating the content is no longer reachable. Evidence indicates a crypto‑related scam: the brand target is Ledger and the scam type is listed as Crypto Scam.

However, the exact malicious payload, credential‑harvesting forms, or redirects have not been captured, leaving the full attack vector uncertain. Defenders should add ldeger-comstart.framer.ai to URL filtering and DNS block lists, monitor other subdomains under framer.ai for similar page titles, and enforce TLS inspection to detect any future content changes. Continuous monitoring of AWS‑hosted IP ranges for anomalous activity related to Ledger impersonation is advised. The offline status reduces immediate risk, but the infrastructure suggests a reusable template that could be re‑activated.