startdownload[.]ghost[.]io

startdownload.ghost.io was first observed on February 21, 2026 after registration through 1API GmbH. The domain resolves to the IPv6 address 2a04:4e42::775, which is announced by AS54113 Fastly, Inc. and geolocated to the United States. DNS resolution is served by Cloudflare name servers woz.ns.cloudflare.com and sara.ns.cloudflare.com. The site presents a TLS certificate issued by Let’s Encrypt (R12) and returns HTTP 301 redirects before delivering content.

The landing page advertises itself as “Exodus® Wallet | Your Complete Guide to Web3 Access”, directly mimicking the legitimate Exodus cryptocurrency wallet brand. Header analysis reveals the use of Varnish, Nginx, and OpenResty as the web stack. The site has been added to a single security blocklist and is currently listed as blocked by PhishDestroy. Independent scanning on VirusTotal recorded four detections out of ninety‑five scanners, and Gridinsoft assigned a trust score of zero out of one hundred, indicating a high likelihood of malicious intent.

Technical indicators collectively point to a brand‑impersonation campaign targeting Exodus users, likely aimed at credential harvesting or fraudulent cryptocurrency transactions. The low detection rate on VirusTotal suggests limited exposure to scanning services, but the presence of a valid TLS certificate and a reputable CDN does not mitigate the risk. Uncertainty remains regarding the exact payload delivered after redirection, as the 301 response prevents direct observation of the final malicious page.

Defenders should block startdownload.ghost.io at network perimeter and add the IPv6 address 2a04:4e42::775 to deny lists. Email and web security solutions should be tuned to flag any communications referencing “Exodus Wallet” that resolve to this domain or its Cloudflare name servers. Continuous monitoring of the domain’s DNS and SSL characteristics is advised, as adversaries may rotate hosting or issue new certificates to evade detection.