indexweb[.]ghost[.]io

Analysis of indexweb.ghost.io shows that the domain was registered on 21 February 2026 through 1API GmbH and currently resolves to 151.101.3.7, an address owned by Fastly, Inc. (AS54113) located in the United States. The authoritative nameservers are woz.ns.cloudflare.com and sara.ns.cloudflare.com, indicating that the domain is fronted by Cloudflare’s DNS infrastructure. The site presents a TLS certificate issued by Let’s Encrypt (R12) and returns an HTTP 301 redirect, which is typical of malicious hosting setups. The page title returned by the server is “Ledger Live Desktop | Secure Crypto Management App”, matching the declared brand target Ledger and the enumerated scam type “Crypto Scam”. Security telemetry shows the domain appears on a single blocklist and is flagged by PhishDestroy. VirusTotal has recorded three positive detections out of ninety‑three scanners, and Gridinsoft assigns a trust score of zero out of one hundred, reinforcing the malicious assessment. The observed web stack includes Varnish, Nginx and OpenResty, a combination often employed to hide payload delivery behind caching and reverse‑proxy layers. Evidence therefore confirms that indexweb.ghost.io is being used to impersonate Ledger’s official services in order to lure cryptocurrency users. No additional public artifacts such as phishing landing pages or credential‑stealing forms have been disclosed, so the exact user‑interaction flow remains unknown. Defenders should block the domain at network perimeter, add the IP address 151.101.3.7 to deny‑list rules, and monitor DNS queries for the associated Cloudflare nameservers. Continuous re‑scanning of the domain on multi‑engine platforms is recommended to capture any future changes in detection rates. Organizations that use Ledger products should alert users to avoid any login attempts on this URL and verify official communications through known Ledger channels.