authhomepage[.]ghost[.]io

As of July 12, 2026, the domain authhomepage.ghost.io has been flagged as a high-risk generic phishing domain. The domain was created on February 21, 2026, and is currently active, indicating a relatively recent and ongoing threat. Analysis of the domain's infrastructure reveals that it is hosted in the United States under the Autonomous System Number (ASN) AS54113, which is associated with Fastly, Inc. The domain resolves to the IP address 151.101.67.7 and is using a combination of technologies including Varnish, Nginx, and OpenResty, suggesting a sophisticated setup that could be leveraged for various malicious activities. The SSL certificate for the domain is issued by Let's Encrypt, which, while not inherently suspicious, is commonly used by both legitimate and malicious actors due to its ease of acquisition and credibility with users. The domain has a Gridinsoft trust score of 0 out of 100, indicating a very low level of trust. It is also blocked by the PhishDestroy system, further confirming its malicious nature. The page title 'Site unavailable' could be an attempt to deceive users or a temporary measure to avoid detection. While the exact content of the site has not been analyzed, the high risk level and the fact that it is still active suggest that it may be part of a broader phishing campaign. Defenders should take immediate action to block this domain and monitor for any related activity. Additionally, users should be educated to avoid clicking on links or entering credentials on any site that appears to be unavailable or redirects unexpectedly. Regular updates to security systems and user awareness training are essential to mitigate the risks associated with such domains.