openledgers[.]sbs

Analysis indicates that the domain openledgers.sbs was employed in a brand‑impersonation operation aimed at Ledger users. The domain was created on 10 September 2025 and registered through Web Commerce Communications Limited, suggesting a relatively recent registration window typical of fraudulent infrastructure. DNS records list amit.ns.cloudflare.com and sandra.ns.cloudflare.com as authoritative nameservers, and the domain resolves to IP address 104.21.42.48, which belongs to Cloudflare, Inc. (AS13335) and is geolocated to the United States. No TLS certificate was observed, and the HTTP response presented the generic page title “Just a moment…”, a pattern often associated with redirection or mitigation pages rather than a legitimate Ledger service.

The site has been flagged by PhishDestroy and appears on a single security blocklist, indicating at least one external detection. Gridinsoft assigned a trust score of 0 out of 100, reinforcing the malicious classification. VirusTotal reported that 1 of 95 scanned security vendors flagged the domain, providing an additional independent indicator of compromise. The combination of a brand‑targeted domain, recent registration, Cloudflare hosting without SSL, low trust score, and detection by multiple security tools suggests that the domain was used to lure victims into a crypto‑related scam.

Uncertainty remains regarding the exact content delivered to users before the takedown, as the page title offers no substantive information. Defenders should continue to block the domain at network and endpoint layers, monitor for any residual DNS or IP activity, and consider adding the associated IP address to deny‑list policies. Ongoing observation of the Cloudflare IP range for similar brand‑impersonation domains is advisable, as the infrastructure may be reused in future campaigns.