faqhelp[.]ghost[.]io

Analysis of faqhelp.ghost.io shows a high‑risk generic phishing infrastructure that remains active as of 12 July 2026. The domain resolves to IP 151.101.67.7, hosted in the United States under ASN 54113 (Fastly, Inc.). HTTP requests return a 301 redirect and the page title reported is "Site unavailable," indicating the site is deliberately hidden or taken offline after initial deployment. DNS is served by Cloudflare name servers (woz.ns.cloudflare.com, sara.ns.cloudflare.com) and the site presents a valid Let’s Encrypt certificate (R12). Registration was completed on 21 February 2026 through 1API GmbH. Technical fingerprinting identifies Varnish, Nginx and OpenResty in the stack, and the Gridinsoft trust score is 0 / 100, reflecting a lack of reputation. The domain appears on a single security blocklist and is actively blocked by PhishDestroy. VirusTotal analysis shows 3 of 95 security vendors flag the domain, reinforcing the suspicion of malicious use. While the exact phishing payload or targeted brand is not observable from the available data, the combination of recent registration, low trust score, active blocklist entry, and vendor detections justifies a high‑risk classification. Defenders should block the domain at network perimeter, monitor DNS queries for the associated IP and name servers, and include the domain in threat‑intel feeds to prevent credential harvesting attempts.