claim-openledger[.]xyz

claim-openledger.xyz was registered through NiceNIC International Group Co., Limited on 2025‑09‑08. The domain resolves to 104.21.14.219, an address owned by Cloudflare, Inc. (AS13335) located in the United States. DNS resolution is handled by Cloudflare nameservers arvind.ns.cloudflare.com and pam.ns.cloudflare.com, confirming the use of Cloudflare’s infrastructure. No TLS certificate is served; the site responds over HTTP and returns a generic HTML page whose title is “Just a moment…”, a pattern commonly observed on Cloudflare‑protected pages.

Reputation profiling is extremely poor: Gridinsoft assigns a trust score of 0 / 100, Scamadviser 1 / 100, and the overall risk rating is listed as elevated. The domain appears on a single external blocklist and is explicitly blocked by the PhishDestroy service. VirusTotal scans show three of ninety‑five engines flag the domain as malicious, aligning with the low trust scores. The only declared target is the hardware‑wallet brand Ledger, indicating a brand‑impersonation campaign likely intended to lure cryptocurrency users.

Because the site is currently taken offline, live content, payload type, and credential‑capture mechanisms cannot be verified; therefore the exact attack vector remains uncertain. Analysts should continue to enforce DNS and URL filtering for claim-openledger.xyz, monitor the associated IP (104.21.14.219) for any future activation, and add the domain to internal threat‑intel repositories. Correlation with other Ledger‑related impersonation domains hosted on Cloudflare should be performed, and any re‑registration attempts using the same registrar or similar naming patterns should trigger alerts. Ongoing observation of the IP reputation and periodic rescanning with updated threat‑intel services are advised.