leddgr-strt[.]framer[.]media

This domain, leddgr-strt.framer.media, is identified as a high-risk brand impersonation resource targeting Ledger, a cryptocurrency hardware wallet provider. Analysis indicates the domain was designed to mimic the official Ledger onboarding page, specifically replicating the Ledger.com/start URL path and page title. The fraudulent page likely aimed to deceive users into entering sensitive recovery phrases or private keys, facilitating unauthorized access to cryptocurrency wallets. Infrastructure analysis reveals the domain was registered through CSC Corporate Domains, Inc. and resolved to the IP address 31.43.161.6. At the time of detection, the domain was flagged by 15 out of 95 security vendors on VirusTotal, indicating moderate to high confidence in its malicious nature. The domain appears on three security blocklists, including PhishDestroy, PhishingArmy, and OISD. The SSL certificate was issued by Let's Encrypt, a common tactic to lend superficial legitimacy to phishing sites. Technologies detected on the domain include Framer Sites, React, HSTS, and HTTP/3, suggesting a modern, dynamically generated phishing infrastructure. As of the latest assessment, leddgr-strt.framer.media has been taken offline, reducing immediate exposure to end users. However, the infrastructure and registration patterns observed may indicate a broader campaign. Users who interacted with the domain prior to its takedown should immediately revoke any permissions granted to associated applications, rotate recovery phrases, and monitor wallet activity for unauthorized transactions. Organizations are advised to update blocklists with the domain and IP address to prevent future access attempts.