guidewallet[.]ghost[.]io

This domain, guidewallet.ghost.io, is actively impersonating Ledger, a cryptocurrency hardware wallet provider, and is classified as a high-risk crypto scam. Registered on October 1, 2011, the domain resolves to 151.101.131.7 (AS54113, Fastly, Inc., US) and is currently serving a 301 HTTP redirect. The page title, 'Ledger Live – The Official Wallet Management App,' directly mimics Ledger’s legitimate software, indicating an intent to deceive users into interacting with fraudulent wallet management tools. Infrastructure analysis reveals the use of Varnish, Nginx, and OpenResty, alongside a Let’s Encrypt SSL certificate (R12), which is consistent with phishing domains attempting to appear legitimate. The domain is flagged by one security blocklist and has been detected by 5 of 95 vendors in a recent scan, though the exact nature of the malicious payload remains unconfirmed. Nameservers are hosted on Cloudflare (sara.ns.cloudflare.com, woz.ns.cloudflare.com), a common tactic to obscure hosting details. Defenders should treat this domain as malicious and prioritize blocking it at the DNS or network level. Further investigation into associated IP ranges, SSL certificate patterns, and redirect chains is recommended to identify related infrastructure. The domain remains active as of July 12, 2026, and no takedown efforts have been observed.