portal[.]openledgerhq[.]click

This domain, portal.openledgerhq.click, is identified as a brand_impersonation phishing infrastructure specifically targeting Ledger, a hardware cryptocurrency wallet provider. Analysis of the page title, 'X. Ajan hermolla / X,' suggests an attempt to mimic legitimate wallet recovery or account verification processes, likely aiming to harvest cryptocurrency wallet credentials or private keys. No drainer kit signatures were explicitly detected in initial scans, though the domain exhibits characteristics consistent with credential harvesting campaigns observed in similar cryptocurrency phishing operations. Infrastructure analysis reveals the domain was registered on September 12, 2025, through Web Commerce Communications Limited. It resolves to the IP address 162.159.140.229, hosted on Cloudflare's network (AS13335) in the United States. The domain lacks an SSL certificate, increasing the likelihood of interception or manipulation of user-submitted data. VirusTotal reports 15 out of 95 security vendors flagging this domain as malicious. The domain appears on two independent security blocklists, and it is currently blocked by PhishDestroy and PhishingDB. No entries were found in Google Safe Browsing at the time of analysis. As of the latest verification, portal.openledgerhq.click has been taken offline, likely due to hosting provider enforcement or registrar intervention. Despite its offline status, residual risk remains for users who may have interacted with the domain prior to its takedown. Organizations and individuals are advised to monitor for unauthorized cryptocurrency transactions, revoke any suspicious wallet authorizations, and implement multi-factor authentication for all cryptocurrency-related accounts. Network defenders should update blocklists to include this domain and its associated IP, while end-users should verify the legitimacy of any Ledger-related communications by cross-referencing with official support channels.