downloadapp[.]ghost[.]io

Analysis of downloadapp.ghost.io indicates an active domain associated with an investment scam, as classified in available threat intelligence. The domain was registered on October 1, 2011, and currently resolves to the IPv6 address 2a04:4e42:600::775, hosted on Fastly, Inc.'s infrastructure (AS54113) in the United States. Infrastructure analysis reveals the use of Varnish, Nginx, and OpenResty technologies, alongside a Let's Encrypt SSL certificate issued under the R12 root. The domain's nameservers are managed by Cloudflare (sara.ns.cloudflare.com and woz.ns.cloudflare.com), a common practice for both legitimate and malicious sites. The domain is flagged on one security blocklist and is actively blocked by PhishDestroy.

The HTTP response status is a 301 redirect, though the destination remains unconfirmed. The page title 'Site unavailable' suggests the domain may not be serving content at present, or it could be a deliberate tactic to evade detection. Gridinsoft assigns a trust score of 0/100, reinforcing its suspicious classification. While 93 vendors have scanned the domain on VirusTotal, none currently detect it as malicious; however, the absence of detections does not confirm safety.

The scam type is explicitly labeled as an investment scam in available intelligence, though the exact content or targeted brand is not detailed in the provided data. Defenders should treat this domain as high-risk, particularly in financial or investment-related contexts. Monitoring for changes in HTTP status, SSL certificate updates, or shifts in hosting infrastructure may provide further indicators of malicious activity. Blocking or sinkholing the domain at the network level is recommended until additional evidence confirms its legitimacy or threat status.