homepage-en[.]ghost[.]io

The domain homepage-en.ghost.io is currently flagged as a high‑risk phishing infrastructure. Registration data shows the domain was created on 21 February 2026 through the registrar 1API GmbH, and it is served from Cloudflare nameservers woz.ns.cloudflare.com and sara.ns.cloudflare.com. DNS resolution points to IP address 151.101.67.7, which belongs to the Fastly network (AS54113) hosted in the United States. HTTP requests receive a 301 redirect, and the TLS certificate is issued by Let’s Encrypt (R12). The web server stack reports Varnish, Nginx and OpenResty, while the page title returned is “Site unavailable.” Reputation signals include placement on a single security blocklist and a detection by PhishDestroy. VirusTotal analysis shows three of ninety‑three scanners flagged the domain, and the Gridinsoft trust score is 0 / 100, indicating a lack of confidence in the site’s legitimacy. No additional content or payload details have been observed, leaving the exact phishing campaign vector uncertain. Given the active status, the confirmed infrastructure, and the existing security detections, defenders should treat homepage-en.ghost.io as malicious. Recommended actions are to add the domain and its resolving IP to blocklists, monitor for any new subdomains or changes in DNS, and ensure that email and web filtering solutions reference the latest threat intelligence feeds that include this indicator.