ledgeerlog[.]framer[.]media

This domain, ledgeerlog.framer.media, is identified as a high-risk brand impersonation threat targeting Ledger, a cryptocurrency hardware wallet provider. The page mimics the official Ledger Live login interface, presenting users with a fraudulent portal titled 'Ledger® Live: Login | Secure Access to Your Wallet.' The objective of this campaign is to harvest user credentials, enabling unauthorized access to cryptocurrency wallets and subsequent asset theft. No specific drainer kit signatures were observed in the available telemetry, though the infrastructure aligns with common credential-harvesting phishing operations. Analysis indicates the domain resolves to the IP address 31.43.160.6 and is registered through CSC Corporate Domains, Inc. Detection metrics reveal a VirusTotal score of 19/95, with security vendors flagging the domain as malicious. The domain appears on three distinct security blocklists, including PhishDestroy, PhishingArmy, and OISD. Infrastructure analysis reveals the use of Framer Sites for hosting, alongside technologies such as React, HSTS, and HTTP/3. The SSL certificate is issued by Let's Encrypt, a common choice for both legitimate and malicious domains due to its accessibility. No Google Safe Browsing (GSB) status was explicitly provided, though the blocklist presence suggests broad detection. As of the latest assessment, ledgeerlog.framer.media has been taken offline, likely due to hosting provider intervention or registrar enforcement. While the immediate threat is mitigated, residual risk persists for users who may have interacted with the domain prior to its deactivation. Affected individuals are advised to revoke any active sessions, rotate credentials, and monitor wallet activity for unauthorized transactions. Organizations should update internal blocklists to include this domain and its associated IP to prevent future access attempts. Continued vigilance is recommended, as threat actors frequently re-deploy similar infrastructure under new domains.