docsofficialweb[.]ghost[.]io

This domain is flagged as a brand impersonation threat targeting Ledger hardware wallet users. Analysis indicates the site presents a fraudulent interface designed to harvest recovery phrases, private keys, or login credentials under the pretense of official Ledger support or software updates. The domain operates under a false identity, exploiting trust in the Ledger brand to deceive victims into disclosing sensitive cryptographic information. Infrastructure analysis reveals multiple technical indicators confirming malicious intent. The domain, docsofficialweb.ghost.io, was registered through 1API GmbH on October 1, 2011, though the phishing content appears to be a recent deployment. It resolves to IP address 151.101.195.7 and uses a Let's Encrypt SSL certificate to mimic legitimacy. VirusTotal reports 8 out of 95 security vendors flagging the domain as malicious, with additional detections on one security blocklist. The site was hosted on Nginx with Varnish and OpenResty, technologies often used to optimize malicious traffic handling and evade detection. If a user visited docsofficialweb.ghost.io and entered any sensitive information, immediate action is required. Disconnect the affected device from the internet to prevent potential remote access. Do not use any credentials or recovery phrases entered on the site. Reset all Ledger-related passwords from a secure device, and generate new recovery phrases for any wallets that may have been exposed. Monitor wallet addresses for unauthorized transactions and consider migrating funds to a new wallet if compromise is suspected. Report the incident to Ledger’s official security team and relevant cybersecurity authorities for further mitigation.