openledgerfoundation[.]icu

Analysis indicates the domain openledgerfoundation.icu is a confirmed crypto scam site impersonating Ledger, a cryptocurrency hardware wallet provider. Registered on September 8, 2025, through PDR Ltd. d/b/a PublicDomainRegistry.com, the domain exhibits multiple indicators of malicious infrastructure. It resolves to IP address 104.21.59.11, hosted on Cloudflare's network (AS13335) in the United States, a common pattern among phishing campaigns leveraging CDN services to obscure origin servers. The domain uses Cloudflare nameservers (beth.ns.cloudflare.com and paul.ns.cloudflare.com) and currently lacks an SSL certificate, increasing the likelihood of interception or tampering during data transmission.

Detection data reveals limited but targeted blocking: the domain appears on one security blocklist (PhishDestroy) and is flagged by 3 of 95 security vendors on VirusTotal. The Gridinsoft trust score of 0/100 further corroborates its malicious classification. The observed page title, 'Just a moment...', is consistent with Cloudflare's interstitial challenge pages, suggesting the site may have employed anti-bot measures or was in the process of loading malicious content when accessed. Defenders should treat this domain as an active threat to users of Ledger products.

The combination of brand impersonation, crypto scam classification, and Cloudflare-hosted infrastructure aligns with known tactics for credential harvesting or cryptocurrency theft. While the domain is currently offline, monitoring for re-activation or associated infrastructure (e.g., IP 104.21.59.11, Cloudflare nameservers) is recommended. No additional content analysis is available; further investigation would require access to historical snapshots or related artifacts. Organizations should update blocklists to include this domain and its resolved IP, and consider proactive detection rules for similar Ledger-themed domains registered through PDR Ltd.