eng-webstart[.]ghost[.]io

eng-webstart.ghost.io is a tenant hostname on Fastly, not a separately registered domain. PhishDestroy first observed the hostname on Feb 26, 2026. The captured page title is “Site unavailable”. Current evidence score: 87/100 (critical).

Positive findings are stored from 4 sources: VirusTotal, DNS security resolvers, Cloudflare Radar, and URLQuery. VirusTotal recorded 9 detections among 93 engines: ADMINUSLabs, alphaMountain.ai, Chong Lua Dao, CRDF, CyRadar, Emsisoft, Lionic, Netcraft, Webroot on Jul 9, 2026 at 02:14 UTC. DNS security checks returned 2 blocking results across 13 tested policies: Cloudflare Family, Cloudflare Security; no observation timestamp was retained. Cloudflare Radar classified the hostname as malicious and assigned the categories security threats and phishing; its verdict timestamp was not retained. URLQuery recorded 3 threat-system alerts on Jan 22, 2026 at 15:04 UTC. Non-positive and contextual checks: The separate external-blocklist snapshot contained no matches on Aug 8, 2026 at 10:20 UTC. Google Safe Browsing returned no flag on Mar 2, 2026 at 20:56 UTC. URLScan completed without a malicious verdict (score 0) on Jul 29, 2026 at 02:50 UTC.

HTTP 301 was recorded on Aug 8, 2026 at 10:01 UTC. Fastly is the hosting platform for this tenant, not its registrar. At collection time, the hostname resolved to 2a04:4e42:600::775 on AS54113 (FASTLY - Fastly, Inc., US). The IP and ASN identify shared Fastly infrastructure, not the tenant operator. The stored server header is openresty. DOM analysis on Jul 9, 2026 at 02:21 UTC returned 78/100. The evidence archive retains 3 visual captures from PhishDestroy, URLScan, and URLQuery. The platform TLS certificate was issued by Let's Encrypt / R12 with validity through May 21, 2026; checked Mar 15, 2026 at 08:10 UTC.

The content indicators and 4 positive source findings support the current phishing classification. The stored fields do not identify an impersonated brand or victim interaction.