onlineuserportal[.]ghost[.]io

The domain onlineuserportal.ghost.io is a phishing site that impersonates the brand Ledger, posing a significant risk to users. This site, which has been taken offline, was used for brand impersonation and targeted cryptocurrency users, potentially leading to financial loss. It is essential to avoid visiting this domain and to take immediate action if any sensitive information was shared.

3 of 95 VirusTotal vendors flagged onlineuserportal.ghost.io as malicious, including CRDF, Ermes, and Gridinsoft. The domain was registered through 1API GmbH on October 01, 2011, and resolves to the IP address 2a04:4e42::775, located in the US under AS54113 Fastly, Inc. The site appeared on 1 security blocklist, PhishDestroy, and used an SSL certificate issued by Let's Encrypt / R12. The page title observed was 'Ledger® Live: Desktop® — Getting™ Started | Official Desktop App', further indicating its intent to impersonate the Ledger brand.

If a user has interacted with onlineuserportal.ghost.io, they should immediately revoke any token approvals and move their cryptocurrency funds to a new, secure wallet. For those who may have entered login credentials, it is crucial to change passwords, enable two-factor authentication, and monitor accounts for any signs of unauthorized activity. Users can report this phishing site to their preferred security vendors and to Ledger directly for further investigation and action.