desktop[.]framer[.]media

The domain desktop.framer.media is identified as a brand_impersonation threat targeting Ledger, a cryptocurrency hardware wallet provider. Analysis confirms the domain was designed to mimic the official Ledger Live software interface, as evidenced by the page title "Ledger Live" found during initial scans. The domain is currently offline, but prior activity indicates a high-risk profile for users of cryptocurrency wallets and related services. Infrastructure analysis reveals the domain was registered on November 19, 2021, through CSC Corporate Domains, Inc. It resolves to the IP address 188.114.96.3, hosted on Cloudflare’s network (AS13335). The domain is flagged by 11 of 95 security vendors on VirusTotal, and it appears on at least one security blocklist. The SSL certificate is issued by Let’s Encrypt (serial number E7), a common choice for both legitimate and malicious domains due to its accessibility. The domain was blocked by PhishDestroy, further confirming its malicious intent. Current status indicates the domain has been taken offline, reducing immediate risk to end users. However, the infrastructure remains a potential vector for future threats. Organizations and individuals are advised to monitor for re-registration or similar domains using variations of "framer" or "Ledger Live." Network defenders should block the domain and associated IP address (188.114.96.3) at the perimeter. Cryptocurrency users should verify all software downloads through official Ledger channels and enable multi-factor authentication on accounts. Security teams are encouraged to review logs for connections to this domain or IP prior to its takedown to assess potential exposure.