learn-ledgr[.]framer[.]wiki

The domain learn-ledgr.framer.wiki was observed resolving to the Amazon‑hosted address 35.71.142.77, an IP registered to AS16509 Amazon.com, Inc. in the United States. Registration records show the domain was created on November 19, 2021 through CSC Corporate Domains, Inc., and it is served by four AWS Route 53 name servers (ns-1185.awsdns-20.org, ns-1827.awsdns-36.co.uk, ns-423.awsdns-52.com, ns-772.awsdns). A Let's Encrypt certificate (identifier E8) protects the site, and the server advertises HSTS and HTTP/3 support, indicating modern web stack components such as Framer Sites and React. When queried the HTTP response returned a 404 status code, and the only visible page title was “Ledger Live Desktop — Official Software for Hardware Wallet”, directly referencing Ledger’s official desktop client.

The title and the reported scam type of “Crypto Scam” together suggest a brand‑impersonation campaign targeting Ledger users, although the actual page content could not be captured because the site is currently offline. Threat intelligence feeds list the domain on a single blocklist, where it is flagged by PhishDestroy, and VirusTotal recorded one positive detection out of ninety‑three scanning engines. No additional public safe‑browsing or OTX entries were found.

Given the combination of a legitimate‑looking page title, the use of Ledger branding, and the presence of a positive security vendor detection, the domain should be treated as hostile. Defensive teams are advised to add the domain and its hosting IP to outbound filtering rules, monitor for any re‑activation of the site, and consider issuing indicators of compromise to threat‑share platforms. Further analysis is limited by the site’s offline status; investigators should revisit the URL if it resurfaces to confirm the presence of credential‑harvesting forms or malicious payloads.