started-connect[.]ghost[.]io

Analysis of the domain started-connect.ghost.io indicates it is actively serving as a phishing infrastructure node. Registered on February 21, 2026, through 1API GmbH, the domain currently resolves to an IPv6 address (2a06:98c1:3121::3) associated with AS13335, operated by Cloudflare, Inc. in the United States. The domain's nameservers are woz.ns.cloudflare.com and sara.ns.cloudflare.com, consistent with Cloudflare's infrastructure. The domain is flagged on one security blocklist and has been assigned a trust score of 0/100 by Gridinsoft. Five of 93 security vendors on VirusTotal have detected the domain as malicious. The site returns an HTTP 301 redirect status, though the destination remains undetermined as the page title displays 'Site unavailable.' No specific brand impersonation or phishing kit has been confirmed at this time, though detected technologies include Varnish, Nginx, and OpenResty, which are commonly used in both legitimate and malicious web infrastructure. Defenders should treat this domain as high-risk due to its presence on blocklists, low trust score, and association with known phishing indicators. The SSL certificate is issued by Let's Encrypt (R12), a common choice for both legitimate and malicious sites. While the exact content or target of the phishing campaign is not yet analysed, the domain's active status and technical indicators warrant immediate blocking and monitoring. Further investigation into redirect chains and any associated domains is recommended.