appdownload[.]ghost[.]io

The domain appdownload.ghost.io is currently flagged as a high‑risk phishing resource. Infrastructure analysis shows the domain resolves to the Amazon‑owned address 18.208.88.157, attributable to AS14618 (Amazon.com, Inc.) and is served from a stack that includes Varnish, Nginx and OpenResty. The authoritative nameservers are sara.ns.cloudflare.com and woz.ns.cloudflare.com, indicating Cloudflare DNS services. The site presents an HTTP 301 redirect and presents a TLS certificate issued by Let’s Encrypt (R12), which is valid but offers no assurance of legitimacy. Registration records list 1API GmbH as the registrar and the domain was created on 1 October 2011.

VirusTotal scans have returned three positive detections out of ninety‑three scanners, and Gridinsoft assigns a trust score of zero out of one hundred. The domain is listed on at least one public security blocklist and has been specifically blocked by the PhishDestroy service. The only visible page title returned by the server is “Site not found,” and no additional content has been disclosed. Evidence confirms the domain’s active status as of 25 July 2026, but the lack of publicly visible malicious pages limits direct attribution of a payload or credential‑stealing page. Defenders should therefore treat any traffic to appdownload.ghost.io as malicious.

Recommended actions include adding the domain and its resolved IP address to network‑level deny lists, ensuring that web‑filtering solutions ingest the PhishDestroy block and the observed blocklist entry, and monitoring for any new sub‑domains or similar redirects that leverage the same hosting infrastructure. Continuous re‑scanning with VirusTotal or comparable multi‑engine scanners is advised to capture any emerging detections. Because the TLS certificate is publicly trusted, TLS‑inspection or SSL‑proxying may be required to inspect payloads.