claim[.]openledgerfund[.]xyz

claim.openledgerfund.xyz was registered through NameSilo, LLC on 10 September 2025. The domain resolves to the Cloudflare edge address 104.21.16.105, which is announced by AS13335 (Cloudflare, Inc.) and geolocated to the United States. Both authoritative name servers are hosted by Cloudflare (javier.ns.cloudflare.com and opal.ns.cloudflare.com), indicating the use of Cloudflare’s DNS and CDN services. No TLS certificate is presented for the host, and HTTPS connections would be refused or downgrade to HTTP, which is consistent with the reported offline status.

The site’s only visible metadata is the page title “Nur einen Moment…”, a German phrase meaning “Just a moment…”, but the content of the page has not been captured. The domain is listed on a single security blocklist and has been flagged by PhishDestroy as a malicious site. VirusTotal analysis shows that two of ninety‑five security vendors have raised detections, reinforcing the suspicion of abuse. Gridinsoft assigns a trust score of zero out of one hundred, the lowest possible rating, indicating a high likelihood of malicious intent.

The domain is explicitly marked as impersonating the Ledger brand, aligning with the classification of a crypto‑related scam. Because the site is currently offline, active probing is limited, but the infrastructure choices—Cloudflare DNS, a recent registration, lack of TLS, and low trust scores—are typical of fast‑flux or throwaway phishing operations. Defenders should continue to block the resolved IP address 104.21.16.105 at network perimeter devices, add the domain to URL filtering lists, and monitor for any re‑appearance under similar naming patterns. Additional scrutiny of related domains registered through the same registrar or using the same Cloudflare name servers is advised, as threat actors often reuse these resources for subsequent campaigns.