gethelp[.]ghost[.]io

On 22 July 2026 the domain gethelp.ghost.io was observed hosting a page titled “Ledger Live”. The page title aligns with the brand target Ledger, indicating a credential‑stealing campaign that pretends to be associated with Ledger’s official services. The domain resolves to the IPv4 address 18.164.124.29, which is advertised as belonging to Amazon.com, Inc. (AS16509) and is geolocated in the United States. The hosting infrastructure is fronted by Cloudflare name servers (woz.ns.cloudflare.com, sara.ns.cloudflare.com) and the web server stack reports Varnish, Nginx and OpenResty, suggesting a typical content‑delivery configuration.

The site presents an HTTP 301 redirect, and the TLS certificate is issued by Let’s Encrypt (R12), a free certificate authority, offering no indication of legitimate ownership. Registration data shows the domain was created on 1 October 2011 and is registered through 1API GmbH. Despite its age, the domain is currently active and appears on a single security blocklist; it has been blocked by PhishDestroy and receives a Gridinsoft trust score of 0/100, reflecting a high likelihood of malicious intent. VirusTotal analysis recorded a single positive detection out of 95 scanned scanners, which is consistent with early‑stage or low‑profile phishing campaigns that evade many vendors.

The observable evidence points to a crypto‑related impersonation attempt targeting Ledger users, leveraging a legitimate‑looking page title and free TLS to increase credibility. Uncertainty remains regarding the full payload, any credential‑capture mechanisms, and whether additional infrastructure (e.g., command‑and‑control servers) is associated with the IP address. Defenders should block the domain at network perimeter, add the IP address 18.164.124.29 to deny‑list filters, monitor DNS queries for the domain and its Cloudflare name servers, and update URL filtering and email security policies to flag any references to “Ledger Live”.