usguide[.]ghost[.]io

usguide.ghost.io is currently active and resolves to 151.101.131.7, an IP owned by Fastly, Inc. (AS54113) located in the United States. The domain was created on 1 October 2011 and is registered through 1API GmbH. DNS resolution uses Cloudflare name servers sara.ns.cloudflare.com and woz.ns.cloudflare.com. HTTP requests receive a 301 redirect response, and the web server stack includes Varnish, Nginx and OpenResty. The site serves a TLS certificate issued by Let’s Encrypt (R12), indicating a valid HTTPS endpoint.

Google Safe Browsing classifies the domain as a social‑engineering threat, and ten of ninety‑three VirusTotal scanners have flagged it as malicious. The Gridinsoft trust score is 0 / 100, and the domain appears on a single external blocklist, where it is listed by PhishDestroy. The page title returned from the host is “Ledger.com/Start® | Getting started — Ledger Support”, and the threat profile labels it as a crypto‑scam impersonating the Ledger brand. Analysis indicates that the infrastructure is typical of credential‑harvesting or crypto‑drain campaigns that leverage reputable CDN providers to mask origin. The presence of a valid TLS certificate and a 301 redirect may be used to funnel victims to a malicious landing page that mimics Ledger support resources, although the exact content of the page has not been captured.

Defenders should block DNS resolution for usguide.ghost.io at the network perimeter, add the IP address 151.101.131.7 to deny lists, and ensure endpoint security solutions incorporate the Google Safe Browsing and VirusTotal detections. Monitoring for outbound connections to Fastly‑hosted resources that reference Ledger‑related URLs can help identify compromised clients. Because the domain is registered through a legitimate registrar and uses Cloudflare name servers, takedown requests may be slower; threat‑intel teams should share indicators of compromise with relevant sink‑hole operators and request removal from additional blocklists.