ledger-en-startt[.]framer[.]ai

The domain ledger-en-startt.framer.ai was identified as a brand‑impersonation vector targeting Ledger users. Analysis shows the site was registered on April 04, 2023 through CSC Corporate Domains, Inc. and currently resolves to IP address 52.223.52.2, which belongs to Amazon.com, Inc. (AS16509) and is geolocated in the United States. The hosting infrastructure presents a Let's Encrypt certificate issued under the E8 identifier, and the web stack includes Framer Sites, React, HSTS and HTTP/3, indicating a modern static‑site deployment.

An HTTP request returns a 404 status code, and the page title captured is "Ledger.com/Start", reinforcing the impersonation claim. Google Safe Browsing classifies the domain as a social‑engineering threat, and PhishDestroy has already blocked it. VirusTotal scans report that nine of ninety‑three security vendors flag the domain as malicious, and it appears on one external security blocklist.

The domain is currently taken offline, but historical activity suggests a crypto‑scam motive as indicated by the "Crypto Scam" label in the intelligence feed. Defenders should immediately block the domain and its resolved IP address at perimeter and DNS layers, continue monitoring for any resurgence, and verify that any internal references to Ledger services are not being redirected to this host. Ongoing vigilance is advised because the underlying hosting provider (Amazon AWS) may host additional malicious assets that could be leveraged in future campaigns.