officialplatforms[.]ghost[.]io

This domain, officialplatforms.ghost.io, is identified as a brand impersonation threat targeting Ledger, a cryptocurrency hardware wallet provider. Analysis indicates the domain hosts a fraudulent replica of the Ledger Live interface, designed to harvest user credentials and private keys. The page title explicitly matches the legitimate Ledger Live application, increasing the likelihood of successful deception among users seeking wallet management tools. Technical indicators reveal multiple red flags associated with this domain. VirusTotal detection shows 5 out of 95 security vendors flagging the domain as malicious, while Gridinsoft assigns a trust score of 0/100. The domain resolves to the IP address 172.66.45.10 and was registered through 1API GmbH on October 01, 2011, though the malicious activity appears to be a recent misuse of the subdomain. The SSL certificate is issued by Let's Encrypt, a common tactic to lend superficial legitimacy. The domain appears on one security blocklist and is blocked by PhishDestroy. Detected technologies include Varnish, Nginx, and OpenResty, which are often used in both legitimate and malicious web infrastructure. As of the latest assessment, officialplatforms.ghost.io has been taken offline, likely in response to security reports or enforcement actions. However, the elevated risk persists due to the domain's history of impersonation and the potential for reemergence under similar infrastructure. Users who may have interacted with this domain are advised to immediately revoke any connected wallet permissions, transfer assets to a new wallet, and monitor for unauthorized transactions. Organizations should update blocklists to include this domain and its associated IP to prevent future access attempts.