started-en-us[.]ghost[.]io

PhishDestroy identifies started-en-us.ghost.io as a high-risk generic phishing domain, primarily targeting users through credential theft techniques. While no specific brand was directly impersonated, the domain's structure suggests an attempt to mimic legitimate services, likely to harvest login credentials. No known drainer kit was associated with this domain, but the phishing intent is clear based on its configuration and security flags.

Technical indicators are alarming: VirusTotal reports 15 out of 95 security vendors flagging this domain as malicious. The domain was registered through 1API GmbH on February 21, 2026, and resolves to IP 151.101.67.7. Google Safe Browsing classifies it as phishing, and it appears on one security blocklist. The SSL certificate was issued by Let's Encrypt (R12), and the page title displayed 'Site unavailable', a common tactic to avoid scrutiny while the phishing infrastructure remains active.

The domain is currently offline, indicating a takedown may have been initiated. However, residual risk remains as similar domains or variations could appear. Users who may have interacted with this domain should change passwords, enable multi-factor authentication, and monitor accounts for suspicious activity. PhishDestroy recommends blocking this domain and its associated IP to prevent future access.