onlinehelp[.]ghost[.]io

onlinehelp.ghost.io was observed serving a page whose title reads “Ledger® Live: Desktop® — Getting Started”. The HTTP response is a 301 redirect, and the TLS certificate is issued by Let’s Encrypt (R12). The domain is registered through 1API GmbH and was created on 01 Oct 2011. DNS resolution points to 151.101.67.7, an address owned by Fastly, Inc. (AS54113) located in the United States, and the authoritative name servers are sara.ns.cloudflare.com and woz.ns.cloudflare.com. Infrastructure fingerprinting shows the presence of Varnish, Nginx and OpenResty, typical of content‑delivery and reverse‑proxy stacks.

The site is listed on a single security blocklist and has a Gridinsoft trust score of 0 / 100, indicating a high likelihood of malicious intent. It is currently blocked by the PhishDestroy service and is tagged as a “Crypto Scam” that impersonates the Ledger brand. VirusTotal reports that the domain has been scanned by 93 vendors, none of which have raised a detection at the time of analysis; this absence of detections does not constitute evidence of safety. Defenders should treat the domain as active and malicious. The combination of a Ledger‑related page title, a 301 redirect, and the use of a reputable CDN suggests a credential‑harvesting or transaction‑draining campaign targeting Ledger users.

Monitoring for DNS queries to the domain, blocking the IP address 151.101.67.7, and adding the domain to web‑filter deny lists are recommended. Additionally, security teams should update URL‑filtering rules to flag any request that resolves to the identified Cloudflare name servers or that presents the same page title. Continuous re‑scanning on VirusTotal and other multi‑engine platforms is advised to capture any future payload changes.