support-started[.]ghost[.]io

This domain, support-started.ghost.io, was observed on July 12, 2026 delivering a high‑risk brand‑impersonation campaign targeting Ledger users. The site presents a page titled “Ledger.com/Start® | Official Ledger® Wallet Guide™”, deliberately mimicking the legitimate Ledger documentation to lure victims into credential harvesting. The phishing infrastructure is identified as active and has already been blocked by the PhishDestroy mitigation system.

The host returns an HTTP 301 redirect and runs a stack that includes Ghost, Node.js, Varnish, Nginx and OpenResty, indicating a typical modern web‑application environment. Domain registration records show the domain was created on March 22, 2026 and was registered through the Ghost platform. Reputation services assign a Gridinsoft trust score of 0 out of 100, and VirusTotal reports that 2 of 95 security vendors flagged the domain. The domain appears on a single security blocklist, confirming its malicious status.

Publicly available data does not disclose the underlying IP address, autonomous system number, or geographic location of the hosting provider, limiting the ability to attribute the infrastructure to a specific threat actor or campaign infrastructure. Additionally, the limited number of detections on VirusTotal suggests that the site may be employing techniques to evade broader scanner coverage, but the precise evasion methods remain unconfirmed.

Defenders should add support-started.ghost.io to outbound web filters and DNS blocklists, enforce strict URL verification for any Ledger‑related links, and monitor network traffic for connections to the identified hosting stack components. Incident response teams should educate end users about the forged “Ledger.com/Start®” title and advise verification of URLs against known Ledger domains. Continuous threat‑intel monitoring is advised to detect any future pivoting of the infrastructure to additional domains or IP ranges.