claim[.]openledger[.]fund

Analysis of claim.openledger.fund, observed on July 24, 2026, indicates that the domain is being used to impersonate Ledger, a well‑known hardware wallet brand, in a crypto‑related scam. The site is currently offline, but forensic records show it resolved to the IP address 188.114.96.3, which belongs to Cloudflare, Inc. (AS13335) and is geolocated in the United States. No SSL certificate was presented, leaving the HTTP channel unencrypted and exposing any transmitted data to interception. The page title returned by the server was "Nur einen Moment…", a phrase that does not reveal any legitimate Ledger branding and is consistent with placeholder or redirect pages often employed in malicious campaigns.

Reputation scoring from Gridinsoft assigned a trust score of 0 out of 100, indicating an extremely low confidence in the domain’s legitimacy. The domain appears on a single security blocklist and has been actively blocked by the PhishDestroy service, reinforcing the view that it is being leveraged for fraudulent activity. VirusTotal analysis shows that the domain was scanned by 95 AV engines, none of which flagged it at the time of scanning; this neutral result should not be interpreted as evidence of safety, as the absence of detections does not preclude malicious intent.

The available data confirm the presence of a brand‑impersonation vector aimed at deceiving cryptocurrency users, but the specific payload, phishing page layout, or credential‑capture mechanisms have not been disclosed publicly. Defenders should continue to block the domain at network perimeter controls, monitor DNS logs for any re‑registration or re‑use of the same host name, and treat any communications referencing claim.openledger.fund as potentially malicious. Ongoing observation of the associated IP range and Cloudflare‑hosted infrastructure is advised, as threat actors frequently migrate to new subdomains or alternate hosting within the same provider.