startupdate[.]ghost[.]io

Analysis indicates that the domain startupdate.ghost.io was active as a credential phishing site until its recent takedown. Registered on February 21, 2026, through 1API GmbH, the domain resolved to IP address 151.101.3.7, hosted on Fastly’s network (AS54113) in the United States. Nameservers woz.ns.cloudflare.com and sara.ns.cloudflare.com suggest Cloudflare infrastructure was employed, while the SSL certificate issued by Let’s Encrypt (R12) remained valid during its operational period. At the time of assessment on July 24, 2026, the domain returned an HTTP 404 status with a page title reading 'Domain error,' signaling its offline state.

Detection data reveals limited but targeted flagging: three of ninety-three security vendors on VirusTotal classified the domain as malicious, and it appeared on a single security blocklist. The domain was also blocked by PhishDestroy, a specialized anti-phishing service. Technologies identified on the infrastructure include Varnish, Nginx, and OpenResty, which are commonly used for caching and reverse proxy setups but offer no definitive indication of the phishing kit or targeted brand. The exact content of the phishing page remains unanalyzed, as no archived captures or forensic evidence were available at the time of reporting.

Defenders should treat this domain as a confirmed phishing vector, particularly for credential theft. Network-level blocks at 151.101.3.7 and associated Cloudflare nameservers may prevent residual exposure. Given the domain’s recent deactivation, monitoring for re-registration or shifts to alternative infrastructure is recommended. No evidence links this campaign to broader threat clusters, but the use of Fastly and Cloudflare aligns with common phishing evasion tactics observed in 2026.