livesupport[.]ghost[.]io

Analysis of the domain livesupport.ghost.io, registered on October 1, 2011, indicates it was actively flagged as a high-risk phishing infrastructure targeting users through a tech support scam. As of July 24, 2026, the domain is offline, returning an HTTP 403 status with a page title labeled 'Suspected phishing site | Cloudflare.' This aligns with Google Safe Browsing’s classification of social engineering content. The domain resolves to 172.66.47.180, hosted on Cloudflare’s network (AS13335), a common proxy service used to obscure malicious infrastructure. Nameservers sara.ns.cloudflare.com and woz.ns.cloudflare.com further confirm Cloudflare’s role in the hosting chain.

Detection data from July 2026 shows 10 of 93 security vendors on VirusTotal flagged the domain as malicious, while PhishDestroy and one additional blocklist have listed it. Gridinsoft assigned a trust score of 0/100, reinforcing its classification as high-risk. The SSL certificate, issued by Let’s Encrypt (R12), is consistent with phishing domains leveraging free, short-lived certificates to appear legitimate. Technologies detected on the domain include Varnish, Nginx, and OpenResty, a stack often used to optimize phishing pages for performance and evasion.

The domain’s registration through 1API GmbH provides no additional attribution, as the registrar is a reseller without direct ties to threat actors. While the exact content of the phishing page is not analyzed, the available evidence—including the page title, Safe Browsing classification, and vendor detections—supports its use in a tech support scam. Defenders should treat this domain as compromised infrastructure and block it at the network level. Given its current offline status, monitoring for reactivation or shifts to new domains with similar naming patterns is recommended.