startfaqs[.]ghost[.]io

This domain, startfaqs.ghost.io, was registered on 2026-02-21 and is currently active. DNS resolution returns the IPv6 address 2a04:4e42:600::775, which belongs to the Fastly network (AS54113) located in the United States. The site serves an HTTPS certificate issued by Let’s Encrypt (R12) and responds with an HTTP 301 redirect. Header analysis reveals the presence of Varnish, Nginx and OpenResty, and the authoritative nameserver is listed as ghost.map.fastly.net. The page title returned by the server is “Ledger Live Desktop — Getting Started | Official Ledger Wallet”, indicating a direct impersonation of the Ledger brand. The threat classification is a crypto‑related scam targeting Ledger users. Gridinsoft assigns a trust score of 0 / 100, and the domain is listed on one public blocklist, with PhishDestroy already blocking it. VirusTotal reports four detections out of ninety‑five scanners, confirming malicious activity. The combination of brand impersonation, low trust score, and multiple vendor detections suggests a high‑risk profile. Uncertainty remains regarding the exact payload or credential‑harvesting mechanisms, as no content analysis is available. Defenders should add startfaqs.ghost.io to URL filtering rules, monitor outbound connections to its Fastly IP range, and enforce strict validation of Ledger‑related domains. Continuous re‑scanning is recommended to capture any evolution of the payload.