teachweb[.]ghost[.]io

Analysis as of July 24, 2026 indicates that the domain teachweb.ghost.io is actively being used in a brand‑impersonation campaign targeting Ledger. The domain was registered on October 01, 2011 through 1API GmbH and is hosted behind Cloudflare (AS13335). DNS resolution points to 172.66.44.70, an IP owned by Cloudflare in the United States. The site is served by a stack consisting of Varnish, Nginx and OpenResty, and presents a valid TLS certificate issued by Let’s Encrypt (R12). An HTTP 301 redirect is observed, and the page title returned is “Ledger Live”, directly referencing the Ledger brand.

Google Safe Browsing flags the site for social engineering, and VirusTotal reports detections by seven of ninety‑five scanned security vendors, confirming a malicious classification. The domain appears on at least one public blocklist and is specifically listed by PhishDestroy as a blocked resource. Cloudflare’s internal trust scoring system (Gridinsoft) assigns a score of 0 out of 100, indicating a lack of trust. The combination of brand impersonation, the “Crypto Scam” label, and the presence of the Ledger brand in the title strongly suggests a phishing or credential‑harvesting operation aimed at Ledger users. Evidence gaps remain regarding the exact content served after the redirect, the presence of any malicious payloads, and the full extent of victim interaction.

Defenders should block the domain at the network perimeter, add it to URL filtering and email security policies, and monitor for any outbound connections to the associated IP. Additional sandbox analysis of the redirected page is recommended to confirm whether credential‑stealing forms or malicious scripts are delivered. Continuous re‑evaluation of VirusTotal and other threat‑intel feeds is advised, as detection counts may increase. Given the high risk rating and active status, immediate mitigation is warranted.