gho-swap[.]org

Analysis of gho-swap.org indicates that the domain was registered on July 21, 2026 through Spaceship, Inc. and is hosted on IP 186.2.175.35, using the authoritative nameservers launch1.spaceship.net and launch2.spaceship.net. The domain appears on a single public blocklist and is currently listed as blocked by the PhishDestroy service, suggesting that threat‑intel feeds have already identified it as malicious. VirusTotal has processed the domain with scans from 91 security vendors; none of the vendors reported a detection at the time of the scan, which is a neutral data point and does not constitute a safety assurance. The domain’s status is marked as active, and no evidence of takedown or sink‑holing has been observed.

No SSL certificate details, HTTP response codes, or page‑title information are available in the present dataset, so the content served by the site cannot be verified. Consequently, the exact phishing vector, targeted brand, or credential‑harvesting technique remains unknown. The lack of public malware signatures combined with the recent registration date suggests a short‑lived campaign that relies on rapid deployment and early blocklist inclusion to evade detection.

Defenders should add the IP address 186.2.175.35 and the domain name gho-swap.org to outbound filtering rules and domain‑blocking lists. Continuous monitoring of DNS queries for the domain and its associated nameservers is recommended, as any change in resolution or additional blocklist listings may indicate escalation. Given the active status and the presence on PhishDestroy, network sensors should flag any traffic to the domain for further inspection, and incident response teams should be prepared to capture potential credential submissions should the site begin serving phishing pages.