rewards[.]openledgers[.]sbs

The domain rewards.openledgers.sbs was registered on September 10, 2025 through Web Commerce Communications Limited and is currently resolved to the Cloudflare IP address 188.114.97.3 (AS13335, United States). The authoritative name servers are amit.ns.cloudflare.com and sandra.ns.cloudflare.com, indicating that the domain is hosted behind Cloudflare’s edge network. No TLS certificate is presented for the host, meaning the site does not offer HTTPS encryption. The page title returned by the HTTP response is "Nur einen Moment…", which provides no indication of the content served.

The domain is classified as a crypto‑scam that impersonates the Ledger brand, and its risk status is listed as "under investigation" while the site is presently offline. Infrastructure analysis shows a Gridinsoft trust score of 0 out of 100 and the domain appears on a single security blocklist, where it is actively blocked by PhishDestroy. VirusTotal records indicate that the domain has been scanned by 95 security vendors, none of which have raised a detection at the time of analysis; however, the lack of detections is not evidence of benign intent.

Observed evidence confirms the impersonation of Ledger and the use of a generic German‑language title, but the exact malicious payload or phishing page layout has not been captured because the site is offline. Defenders should continue to monitor the domain for re‑activation, block the associated IP address and hostnames at perimeter defenses, and add the domain to internal threat‑intel feeds. Given the zero trust score, blocklist presence, and brand‑impersonation behavior, the domain should be treated as malicious until a definitive takedown confirmation is received.