app[.]ghostfunds[.]xyz

PhishDestroy identifies app.ghostfunds.xyz as a confirmed crypto drainer scam currently under active investigation. The domain impersonates legitimate cryptocurrency fund recovery services, specifically targeting users seeking to reclaim held digital assets. The threat involves malicious wallet drainers designed to steal cryptocurrency during fraudulent fund recovery transactions.

The domain app.ghostfunds.xyz exhibits multiple red flags across multiple detection layers. Flagged by 3 of 95 VirusTotal vendors as of the latest scan, the site leverages a Let's Encrypt SSL certificate for superficial legitimacy. Domain registration details reveal creation on December 25, 2024, through NAMECHEAP INC, resolving to IP address 75.2.60.5. While not currently blocklisted, the domain's recent creation date, coupled with the complete lack of vendor detection, raises significant concerns about its operational timeline and potential for rapid expansion in scam campaigns. The combination of recent registration, absence of detection, and the specific crypto drainer threat vector places this domain in a high-risk category despite current low detection metrics.

This domain remains active and represents an immediate threat to cryptocurrency users seeking fund recovery solutions. PhishDestroy recommends immediate avoidance of app.ghostfunds.xyz and any associated domains. Users should conduct thorough verification through PhishDestroy's threat intelligence platform before initiating any cryptocurrency-related transactions. Additionally, we advise reporting this domain to cryptocurrency platforms and recovery services to prevent further victimization. The current status requires heightened vigilance from security professionals and immediate action from domain registrars and hosting providers to prevent continued exploitation.