officialpage[.]ghost[.]io

The domain officialpage.ghost.io is currently active and classified as a high‑risk brand‑impersonation operation targeting Ledger users. Infrastructure analysis shows the domain resolves to IP address 172.66.47.7, which is hosted by Cloudflare (ASN13335) and located in the United States. The domain is served through a stack that includes Varnish, Nginx and OpenResty, and presents a valid TLS certificate issued by Let’s Encrypt (R12). HTTP requests receive a 301 redirect response, and the page title reported by scanners is "Ledger Live", matching the brand target. The registrar listed is 1API GmbH, with the domain creation date recorded as 01 October 2011.

Trust scoring from Gridinsoft assigns a zero‑out‑of‑100 rating, indicating an extremely low reputation. VirusTotal scans have flagged the domain by 11 of 95 security vendors, and the domain appears on at least one public blocklist. It is also listed by PhishDestroy as blocked. Nameserver configuration uses sara.ns.cloudflare.com and woz.ns.cloudflare.com, confirming the Cloudflare service relationship. The available intelligence points to a crypto‑scam motive, though the specific payload or credential‑stealing mechanisms have not been publicly disclosed.

Uncertainty remains regarding the exact phishing page content, the presence of any malicious scripts, and whether the domain is part of a larger campaign infrastructure. Defenders should add officialpage.ghost.io to blocklists at the network perimeter, enforce DNS filtering, and monitor TLS connections to the IP 172.66.47.7 for anomalous traffic. Endpoint security solutions should flag any attempts to resolve or connect to this domain, and security teams should correlate logs with the observed 301 redirect pattern and the "Ledger Live" page title to identify potential victim interactions. Continuous re‑scanning with multi‑vendor services is advised to capture any evolution in the threat profile.