securepage[.]ghost[.]io

The domain securepage.ghost.io is currently active and classified as a high‑risk brand‑impersonation threat targeting the Ledger brand. Infrastructure analysis shows the site is served by a Let's Encrypt R12 certificate and hosts on a stack that includes Varnish, Nginx, and OpenResty. The domain resolves to IP 151.101.67.7, which belongs to AS54113 Fastly, Inc. and is geolocated in the United States. Registration records indicate the domain was created on 01 Oct 2011 through the registrar 1API GmbH, and it uses Cloudflare nameservers (woz.ns.cloudflare.com, sara.ns.cloudflare.com). HTTP requests return a 301 redirect, and the page title observed is "securepage". Reputation data includes a Gridinsoft trust score of 0 / 100, placement on one security blocklist, and a block by PhishDestroy. VirusTotal scans report 7 of 95 security vendors flagging the domain. The combination of a low trust score, active blocklist entries, and multiple vendor detections supports the high‑risk rating. Defenders should immediately block the domain at perimeter and endpoint controls, monitor DNS queries for the associated IP and nameservers, and advise users to avoid any unsolicited communications that reference Ledger and direct traffic to this URL. Ongoing observation is recommended to detect any changes in the site’s content or additional malicious activity.