weblearn[.]ghost[.]io

Analysis of weblearn.ghost.io shows a high‑risk wallet/seed phishing campaign that impersonates the brand “base”. The domain resolves to 151.101.3.7, an IP owned by Fastly, Inc. (AS54113) located in the United States, and is fronted by Varnish, Nginx and OpenResty. It serves an HTTP 301 redirect and presents a TLS certificate issued by Let’s Encrypt (R12). The registrar listed is 1API GmbH, and the domain was created on 01 Oct 2011.

Reputation data is poor: Gridinsoft assigns a trust score of 0 / 100, the site appears on one security blocklist, and PhishDestroy has already blocked it. Ten of ninety‑three VirusTotal scanners flag the domain, indicating moderate detection consensus. The page title “Getting started | Exodus Knowledge Base” is the only visible content; no further page analysis is available.

Defenders should immediately add weblearn.ghost.io to URL filtering and DNS blocklists, monitor connections to its Fastly edge IP, and enforce strict outbound traffic controls to prevent seed leakage. Security teams should also educate users about unsolicited requests for wallet seeds, especially those masquerading as “base” support resources, and verify any legitimate Exodus documentation against known official domains. Continuous threat‑intel feeds should be consulted for updates, and any observed traffic to this domain should be logged for incident response.