webhelp[.]ghost[.]io

The domain webhelp.ghost.io is identified as a phishing site engaging in brand impersonation of Ledger, a cryptocurrency-related service. It poses a scam threat by attempting to deceive users into interacting with a fake Ledger Live interface. The site has been taken offline and is currently under investigation for its malicious activity. This domain is not safe to visit due to its involvement in phishing targeting Ledger users.

Technical indicators for webhelp.ghost.io include zero detections out of 95 VirusTotal vendors, registration through 1API GmbH, and a creation date of October 1, 2011. The domain resolves to the IP address 2a04:4e42:600::775 located in the US under AS54113 Fastly, Inc. It appears on one security blocklist, PhishDestroy, and uses an SSL certificate issued by Let’s Encrypt / R12. The page title observed was 'Ledger Live - Secure Crypto Portfolio Management | Official App,' and the site employed technologies such as Varnish, Nginx, and OpenResty.

Users who encountered webhelp.ghost.io should be cautious of potential phishing attempts targeting Ledger credentials. It is recommended to change passwords associated with Ledger accounts, enable two-factor authentication where possible, and monitor accounts for any unauthorized transactions. Reporting the phishing domain to security blocklists like PhishDestroy or to the legitimate Ledger support team can aid in preventing further victimization. Avoid interacting with suspicious links claiming to be Ledger to maintain safety.