iostart-eng[.]ghost[.]io

The domain iostart-eng.ghost.io is currently classified as a high‑risk generic phishing infrastructure. It was registered on 21 February 2026 through 1API GmbH and remains active as of 12 July 2026. The site presently returns an HTTP 301 redirect and its only observable page title is “Site unavailable”, indicating that the malicious landing page is not directly exposed.

Technical reconnaissance shows that iostart-eng.ghost.io resolves to the IP address 151.101.3.7, which belongs to the Fastly network (AS54113) located in the United States. The domain is served by Cloudflare nameservers woz.ns.cloudflare.com and sara.ns.cloudflare.com, and the TLS certificate is issued by Let’s Encrypt (R12). HTTP headers reveal the presence of Varnish, Nginx and OpenResty, a common stack for high‑performance content delivery.

Reputation services assign the domain a Gridinsoft trust score of 0 out of 100 and report its inclusion on a single external blocklist. VirusTotal analysis indicates that 3 of 95 scanned security vendors flagged the domain, reinforcing the phishing designation. Additionally, the domain is listed as blocked by the PhishDestroy feed, confirming its use in active phishing campaigns.

While the visible content is limited to the generic “Site unavailable” title, the combination of recent registration, low trust score, confirmed blocklist entries, and the Fastly‑based hosting environment suggests a purpose‑built phishing operation. Defenders should prioritize outbound filtering to block connections to 151.101.3.7, enforce DNS sinkholing of iostart-eng.ghost.io, and monitor for any newly observed sub‑domains or redirects. Continuous re‑evaluation is advised as additional indicators may emerge.