openledger[.]fund

The domain openledger.fund is identified as a high-risk brand impersonation threat targeting the cryptocurrency hardware wallet brand Ledger. The domain does not deploy a known crypto drainer kit but is suspected of attempting to trick users into divulging sensitive information such as login credentials or private keys.

Infrastructure analysis reveals that openledger.fund is registered through NameSilo, LLC and resolves to the IP address 172.67.134.99, which is located in the United States and associated with AS13335 Cloudflare, Inc. The domain was created on September 09, 2025, and is currently listed on one security blocklist. VirusTotal reports that the domain is flagged by 1 out of 95 security vendors, indicating a low but significant level of suspicion. The domain does not have an SSL certificate, which is often a red flag for security-conscious users.

The domain remains active as of the latest analysis. Given its status on a security blocklist and the fact that it impersonates a well-known brand, the risk to potential victims is high. It is recommended that users avoid interacting with this domain and report any suspicious activity to their security teams. Additionally, security professionals should monitor for any further developments and consider adding this domain to their blocklists to mitigate the risk of credential theft or other malicious activities.