startprimary[.]ghost[.]io

The domain startprimary.ghost.io was registered on February 21, 2026 and is currently active. DNS resolution points to IP 151.101.67.7, an address owned by Fastly (AS54113) and commonly used for content delivery. The web server stack includes Varnish, Nginx, and OpenResty, while the domain is delegated to Cloudflare nameservers (woz.ns.cloudflare.com, sara.ns.cloudflare.com). TLS is provided by a Let's Encrypt certificate and the site issues an HTTP 301 redirect, returning the page title "Site unavailable". Threat intelligence shows the domain appears on one security blocklist, has a Gridinsoft trust score of 0/100, and is flagged by PhishDestroy. VirusTotal analysis recorded 10 detections out of 93 scanners, reinforcing the high‑risk classification. The combination of a newly created domain, use of reputable CDN and DNS providers, and multiple security vendor alerts suggests an intentional attempt to host a phishing payload while leveraging trusted infrastructure to evade simple reputation checks. Defenders should immediately block the domain and its associated IP at perimeter and DNS filters, monitor for any sub‑domains or similar Fastly‑hosted addresses, and update detection signatures to include the observed server fingerprint (Varnish/Nginx/OpenResty) and the specific TLS certificate issuer. Ongoing observation of traffic to the Fastly IP range and periodic re‑scanning of the domain are recommended to capture any evolution of the malicious content.