portal[.]openledgerfoundations[.]network

Analysis indicates that portal.openledgerfoundations.network is an active brand-impersonation domain targeting Ledger, a cryptocurrency hardware wallet provider. The domain was registered through PDR Ltd. d/b/a PublicDomainRegistry.com and currently resolves to the IP address 104.21.96.1, which is associated with Cloudflare infrastructure. The site employs HTTP/3 and is protected by a Google Trust Services SSL certificate, a common configuration for both legitimate and malicious sites to evade basic detection. The page title, 'Cierpliwości...', suggests the site may be designed to display a loading or waiting message, though the exact content and functionality remain unconfirmed as the page has not been directly analyzed. The domain appears on one security blocklist and is flagged by PhishDestroy. Gridinsoft assigns it a trust score of 0/100, and six of 95 security vendors on VirusTotal detect it as malicious. These indicators collectively point to a high-risk classification. Infrastructure analysis reveals the use of Cloudflare, which is frequently leveraged by threat actors to obscure hosting details and mitigate takedown efforts. The domain's registration via PublicDomainRegistry.com aligns with patterns observed in other phishing campaigns, where bulk registrars are used to rapidly deploy and replace malicious domains. Defenders should treat this domain as actively hostile and prioritize blocking or monitoring any traffic directed to it. Given the targeting of Ledger users, organizations handling cryptocurrency transactions should alert users to verify domain authenticity before interacting with any wallet-related sites.