ledgerapps[.]ghost[.]io

This domain, ledgerapps.ghost.io, is a confirmed brand impersonation site targeting Ledger, a provider of cryptocurrency hardware wallets. The site is designed to deceive users into entering sensitive credentials, such as recovery phrases or private keys, by mimicking Ledger’s official web presence. Such attacks typically lead to unauthorized access to cryptocurrency wallets, resulting in financial theft. The domain currently displays a 'Site unavailable' message, but prior activity indicates it was operational for malicious purposes. Analysis indicates the domain was created on October 01, 2011, and is registered through 1API GmbH. Despite its long registration history, it appears on one security blocklist and is flagged by 1 out of 95 security vendors on VirusTotal. Infrastructure analysis reveals the domain resolves to the IP address 151.101.3.7 and employs technologies such as Varnish, Nginx, and OpenResty. The SSL certificate is issued by Let's Encrypt, a common tactic to lend false legitimacy to phishing sites. The Gridinsoft trust score of 0/100 further confirms its malicious nature. If you visited ledgerapps.ghost.io, immediately cease all interaction with the site. Revoke any permissions granted to wallet applications linked to this domain and transfer assets to a new, secure wallet. Monitor all connected accounts for unauthorized transactions and enable multi-factor authentication where available. Report the incident to your organization’s security team or a trusted incident response provider. Users should also verify the authenticity of any Ledger-related communications by cross-referencing with official Ledger channels.