live-started[.]ghost[.]io

This domain is flagged for hosting a fake login portal, a type of phishing infrastructure designed to harvest credentials by mimicking legitimate authentication interfaces. The risk level is elevated due to confirmed malicious activity and detection by multiple security mechanisms. Analysis indicates this domain was likely used in targeted credential theft campaigns prior to being taken offline. Infrastructure analysis reveals the domain live-started.ghost.io was registered on February 21, 2026, through 1API GmbH, a registrar frequently associated with phishing domains. It resolves to the IP address 151.101.67.7, geolocated in the United States under AS54113 (Fastly, Inc.). The domain appears on one security blocklist and is flagged by 11 out of 95 security vendors on VirusTotal, indicating moderate to high confidence in its malicious classification. The SSL certificate is issued by Let's Encrypt (R12), a common choice for both legitimate and malicious sites due to its free and automated issuance process. The page title, 'Site unavailable,' suggests the domain may have been recently disabled or abandoned following detection. Mitigation steps for organizations and end users include blocking the domain and its associated IP address (151.101.67.7) at the network perimeter. Security teams should review logs for connections to this domain or IP, particularly those involving authentication attempts or credential submissions. End users who may have interacted with the domain should reset passwords for any accounts accessed during the exposure window and enable multi-factor authentication where available. Given the domain's registration date and detection timeline, monitoring for similar infrastructure registered through 1API GmbH or resolving to Fastly IP ranges may help preempt future threats.