iostarthelp[.]ghost[.]io

Analysis of iostarthelp.ghost.io shows a domain registered on February 21 2026 through 1API GmbH that remains active despite being listed on a security blocklist. The site is currently blocked by PhishDestroy, indicating that it has been identified as a phishing vector and is being actively mitigated by at least one external sinkhole.

Infrastructure investigation reveals that the domain resolves to the IP address 151.101.3.7, which belongs to AS54113 Fastly, Inc. and is geolocated in the United States. The authoritative nameservers are woz.ns.cloudflare.com and sara.ns.cloudflare.com, suggesting the use of Cloudflare’s DNS service. HTTP requests receive a 301 redirect response, and the web server stack consists of Varnish, Nginx, and OpenResty, all common components for high‑performance content delivery networks.

The TLS certificate is issued by Let’s Encrypt (R12), providing encryption but not authentication of the underlying intent. VirusTotal has flagged the domain in 5 of 95 scanned security vendors, and the Gridinsoft trust score is 0 out of 100, reflecting a consensus of malicious classification. The page title returned by the server is "Site unavailable," a common tactic used to obscure the true content while maintaining a reachable endpoint.

Given the converging indicators—active status, blocklist presence, low trust score, and multiple vendor detections—defenders should treat iostarthelp.ghost.io as a confirmed phishing host. Recommended actions include adding the domain to outbound web filters, monitoring DNS queries for the associated Cloudflare nameservers, and updating intrusion detection signatures to flag HTTP 301 redirects to this IP range. Continuous re‑evaluation is advised, as further payloads or credential‑stealing pages could be deployed behind the current placeholder content.