portals-openledgerfoundation[.]top

On July 23, 2026, analysis identified the domain portals-openledgerfoundation.top as part of a credential‑harvesting infrastructure that masquerades as the Ledger brand. The site presented the HTML title “Open Ledger”, a clear indicator of brand impersonation. WHOIS data shows the domain was registered on 21 February 2026, and DNS resolution points to the IP address 172.67.154.163, which belongs to Cloudflare, Inc. (AS13335) and is geolocated in the United States. The TLS certificate presented is identified as “WE1”, confirming the use of a valid‑looking HTTPS endpoint. VirusTotal scans returned three positive detections out of ninety‑three engines, reinforcing the malicious classification.

The activity has been catalogued as a “Crypto Scam” and is explicitly listed as impersonating Ledger. Independent threat‑intel feeds have added the domain to two blocklists, specifically PhishDestroy and ScamSniffer, confirming that security vendors have observed malicious behavior associated with the host. Current HTTP probing indicates the service is offline, suggesting the operators have taken the site down, either temporarily or permanently. No additional evidence such as page content, login forms, or redirects was available at the time of analysis.

Given the observed indicators, defenders should continue to block the domain at perimeter and DNS layers, monitor Cloudflare‑associated IP ranges for re‑use, and add the domain to internal threat‑intel feeds. Since the infrastructure resides on a shared CDN, future malicious sites may appear on the same IP address; therefore, correlation with other Ledger‑related phishing attempts is recommended. Ongoing watch‑listing of the domain creation date and its association with the “WE1” certificate can aid in early detection of re‑registration attempts. The combination of brand impersonation, a valid‑looking TLS certificate, and partial VirusTotal detections makes portals-openledgerfoundation.