publicpage[.]ghost[.]io

The domain publicpage.ghost.io was identified as a generic phishing site posing an elevated risk for credential theft or malicious redirection. No specific brand impersonation or drainer kit was detected. As of the latest verification, publicpage.ghost.io has been taken offline, though prior activity classified it as a phishing threat.

Technical indicators confirm the domain's suspicious nature. Six of 95 VirusTotal security vendors flagged publicpage.ghost.io, including ADMINUSLabs, ChainPatrol, and alphaMountain.ai. The domain appears on one security blocklist (PhishDestroy) and is registered through 1API GmbH, with a creation date of October 1, 2011. It resolves to the IP address 172.66.44.116, hosted on Cloudflare's infrastructure (AS13335) in the US. The SSL certificate is issued by Let's Encrypt (R12), and the observed page title was 'Suspected phishing site | Cloudflare'. Technologies detected include Varnish, Nginx, and OpenResty, with an HTTP status of 402. Gridinsoft assigned a trust score of 0/100, further indicating its malicious classification.

Individuals who may have interacted with publicpage.ghost.io should immediately change any credentials entered on the site, enable two-factor authentication (2FA) on affected accounts, and monitor for unauthorized activity. No cryptocurrency drainer was identified, so token revocation is not required unless additional evidence suggests otherwise. To report the domain, victims can submit it to platforms like Google Safe Browsing, PhishTank, or their local cybersecurity authority. If financial or identity fraud is suspected, contact relevant institutions and credit bureaus to secure accounts.