startk[.]ghost[.]io

Analysis of the domain startk.ghost.io confirms its classification as an active phishing site targeting users of the Exodus cryptocurrency wallet. The domain, registered on February 21, 2026, through 1API GmbH, currently resolves to 151.101.195.7 (AS54113, Fastly, Inc., United States) and is hosted behind Cloudflare nameservers woz.ns.cloudflare.com and sara.ns.cloudflare.com. The page title, 'EXODUS® Web3 Wallet™ | Getting Started With Exódus®,' explicitly impersonates the Exodus brand, incorporating minor typographical alterations (e.g., 'Exódus') likely intended to evade brand-monitoring tools while maintaining visual similarity to the legitimate service. Infrastructure analysis reveals the use of Varnish, Nginx, and OpenResty, a common stack for phishing kits designed to handle high volumes of traffic and evade detection. The domain returns an HTTP 301 redirect, which may indicate an attempt to funnel victims to a secondary malicious endpoint or obscure the final destination. A Let's Encrypt SSL certificate (R12) is present, providing a superficial appearance of legitimacy while failing to mitigate the underlying threat. The domain is flagged by one security blocklist and has been detected by 2 of 93 vendors on VirusTotal, though the specific detection rules or signatures are not disclosed in available intelligence. The scam type is classified as a crypto scam, consistent with the impersonation of a Web3 wallet. No evidence currently links this domain to a specific phishing kit or broader campaign, and the exact mechanics of the fraudulent scheme (e.g., credential harvesting, wallet-draining scripts, or fake token giveaways) remain unconfirmed. Defenders should prioritize blocking the domain and its resolving IP, monitoring for related infrastructure (e.g., domains with similar naming patterns or hosting on Fastly/Cloudflare), and alerting users to the risk of brand impersonation targeting cryptocurrency services.