publichub[.]ghost[.]io

publichub.ghost.io is currently active and hosts a page titled “Ledger® Live: Desktop® — Getting Started | official Ledger Wallet™ App® (official)”. The site registers the Ledger brand, indicating a high‑risk brand‑impersonation campaign targeting cryptocurrency users. Infrastructure analysis shows the domain resolves to 151.101.131.7, an address owned by AS54113 Fastly, Inc. in the United States, and is fronted by Varnish, Nginx and OpenResty. DNS is served by Cloudflare nameservers sara.ns.cloudflare.com and woz.ns.cloudflare.com, and the TLS certificate is issued by Let’s Encrypt (R12). The domain was created on 1 Oct 2011 and is managed through the registrar 1API GmbH. Reputation data include a Gridinsoft trust score of 0/100, a Google Safe Browsing classification of SOCIAL_ENGINEERING, and inclusion on one security blocklist. PhishDestroy has already blocked the domain, and VirusTotal records show eight of ninety‑three scanners flagging it as malicious. The HTTP response is a 301 redirect, which may be used to conceal the final landing page. While the exact payload and credential‑capture mechanisms have not been publicly disclosed, the combination of brand impersonation, cryptocurrency focus, and multiple security detections warrants immediate mitigation. Defenders should add the domain and its resolved IP to block lists, monitor for related Fastly edge nodes, and enforce strict outbound filtering for any connections to this host. Ongoing observation is recommended to detect any evolution of the campaign.