premierwallet[.]ghost[.]io

Analysis of premierwallet.ghost.io indicates a high-risk crypto scam actively impersonating Ledger, a hardware wallet provider. The domain, registered on October 1, 2011, exhibits multiple threat indicators consistent with brand impersonation. Infrastructure analysis reveals it resolves to 151.101.67.7, hosted on AS54113 (Fastly, Inc.) in the United States, with Cloudflare nameservers (woz.ns.cloudflare.com, sara.ns.cloudflare.com). The domain is flagged by 9 of 95 security vendors, appears on one security blocklist, and is explicitly blocked by PhishDestroy. A 301 HTTP redirect suggests an attempt to funnel traffic to malicious endpoints, while the page title 'Ledger Live Desktop — Get Started|new setup' directly references Ledger’s software, reinforcing the impersonation theme. Technologies detected include Varnish, Nginx, and OpenResty, which are commonly used in both legitimate and malicious infrastructure. The SSL certificate, issued by Let’s Encrypt (R12), provides encryption but does not validate legitimacy. Google Safe Browsing classifies the domain under 'SOCIAL_ENGINEERING,' aligning with the reported scam type. The Gridinsoft trust score of 0/100 further corroborates the high-risk assessment. Defenders should treat this domain as an active threat. Blocklist the domain and its resolving IP at perimeter security controls. Monitor for related infrastructure, such as subdomains or newly registered lookalike domains, which may emerge as part of the same campaign. Given the explicit targeting of Ledger users, organizations handling cryptocurrency transactions should alert employees and customers to avoid interaction with this domain. The exact content and functionality of the site remain unanalyzed, but the combination of brand impersonation, social engineering flags, and security vendor detections justifies immediate containment measures.