startup-eng[.]ghost[.]io

startup-eng.ghost.io was first observed on July 12, 2026 as part of a high‑risk generic phishing campaign. The domain was registered on February 21, 2026 through the registrar 1API GmbH. DNS resolution points to the IP address 151.101.195.7, which belongs to AS54113 Fastly, Inc. in the United States. The authoritative nameservers are woz.ns.cloudflare.com and sara.ns.cloudflare.com, indicating Cloudflare DNS services. An HTTP 301 redirect is returned, and the TLS certificate is issued by Let’s Encrypt (R12), confirming the use of standard free SSL. Server headers reveal a stack of Varnish, Nginx and OpenResty, a common configuration for content‑delivery networks.

Security telemetry assigns a Gridinsoft trust score of 0 out of 100, reflecting an extremely low reputation. VirusTotal analysis shows that 3 of 95 scanned security vendors flagged the domain, and the indicator appears on a single public blocklist. PhishDestroy has already added the domain to its blocklist, confirming active mitigation by at least one anti‑phishing service.

The only visible page title returned is “Site unavailable”, and no further content has been captured. Consequently, the specific brand or service being spoofed cannot be confirmed from the available data. The classification as generic_phishing is based on the threat type label provided, but the exact luring technique, credential‑capture page, or payload remains unknown.

Defenders should immediately block 151.101.195.7 and the domain startup-eng.ghost.io at perimeter firewalls and DNS resolvers. Monitoring for additional sub‑domains under the same registrar or similar name‑server pairs is advised. Given the low trust score and existing vendor flags, sinkholing the IP or redirecting traffic to a safe response page can reduce user exposure while further forensic collection is performed.