officialblog[.]ghost[.]io

The domain officialblog.ghost.io is currently classified as a generic phishing infrastructure and remains active as of the report date, July 24, 2026. Registration details indicate the domain was created on October 01, 2011 through the registrar 1API GmbH. The authoritative name servers are sara.ns.cloudflare.com and woz.ns.cloudflare.com, which resolve the domain to the IP address 151.101.67.7. This address is allocated to Fastly, Inc. (AS54113) and is geo‑located in the United States.

The web server stack reports the presence of Varnish, Nginx and OpenResty, and the HTTP response is a 301 redirect. The page title returned by the server is "Site unavailable" and the SSL certificate is issued by Let’s Encrypt (certificate profile R12). Reputation checks show a Gridinsoft trust score of 0 out of 100 and the domain is listed on a single security blocklist. It is also flagged by the PhishDestroy blocklist.

VirusTotal analysis has recorded scans from 93 vendors, none of which have raised a detection at the time of scanning; this absence does not constitute a safety assurance. The limited publicly observable surface suggests the domain is being used as a redirect or placeholder within a broader phishing campaign, but the exact payload or target brand has not been disclosed. Defenders should consider enforcing network‑level blocks for the IP 151.101.67.7 and the domain officialblog.ghost.io, monitor for any changes in HTTP status or content, and incorporate the domain into security information and event management (SIEM) correlation rules to detect potential exploitation attempts. Continuous re‑evaluation is advised given the active status and the presence on at least one blocklist.