us-publicstart[.]ghost[.]io

The domain us-publicstart.ghost.io was registered on February 21, 2026 through the registrar 1API GmbH and remains active as of the report date. DNS resolution points to the IP address 151.101.3.7, which belongs to AS54113 Fastly, Inc. in the United States and is served by Cloudflare nameservers (woz.ns.cloudflare.com, sara.ns.cloudflare.com). The site presents an HTTP 301 redirect and serves a TLS certificate from Let’s Encrypt issued under the R12 profile. Infrastructure fingerprints show a stack of Varnish, Nginx and OpenResty, consistent with a typical content‑delivery configuration. The page title returned by the server is "Site unavailable," and no further page content has been captured. Threat intelligence indicates the domain appears on one security blocklist, is blocked by PhishDestroy, and has a Gridinsoft trust score of 0 out of 100. VirusTotal analysis shows three of ninety‑three scanners flag the domain, suggesting a low but non‑zero detection consensus. While the exact phishing payload or targeted brand is not yet disclosed, the combination of recent creation, low trust score, and active blocklist presence aligns with a high‑risk generic phishing classification. Defenders should consider adding the domain to network deny lists, monitoring DNS queries for the associated IP and nameservers, and employing URL filtering to prevent user access. Continuous re‑scanning is recommended to capture any evolving malicious content.