live-ledgr-enus[.]framer[.]ai

Analysis of live-ledgr-enus.framer.ai shows a domain created on January 06, 2018 that resolves to the Amazon-owned address 52.223.52.2, located in the United States under ASN 16509. The domain is registered through CSC Corporate Domains, Inc. and uses a Let's Encrypt certificate issued to the host name. The site title observed during the brief crawl reads "Download and install Ledger Wallet™ formerly Ledger," indicating an explicit attempt to impersonate the Ledger brand. The domain is listed on one security blocklist and is actively blocked by PhishDestroy, confirming that at least one reputable feed treats it as malicious.

The infrastructure stack reports Framer Sites, React, HSTS, and HTTP/3, and the authoritative name servers are ns-114.awsdns-14.com, ns-1198.awsdns-21.org, ns-1902.awsdns-45.co.uk, and ns-635.awsdns. An HTTP request returned a 404 status, and the current operational status is marked offline, limiting real‑time content inspection. VirusTotal has processed the domain with 95 scanning engines, none of which flagged it at the time of analysis; however, the absence of detections does not constitute a safety guarantee. The threat classification supplied tags the activity as a crypto scam, specifically a brand impersonation targeting Ledger users.

Defenders should continue to block the domain, monitor the associated IP range for any re‑activation, and consider adding the domain to internal deny lists. Further investigation is needed to determine whether the site ever hosted malicious payloads or credential‑harvesting forms, as the offline state prevents verification of the exact page contents. Until additional evidence emerges, the domain should be treated as a high‑risk impersonation vector.