startdesktop[.]ghost[.]io

Analysis of startdesktop.ghost.io shows a recent web asset created on February 21, 2026 and currently hosted on an IPv6 address (2a04:4e42:200::775) associated with Fastly, Inc. (AS54113) in the United States. The site presents a 301 redirect and returns the page title "Site unavailable". TLS is provided by a Let’s Encrypt R12 certificate, and the hosting stack reports Varnish, Nginx, and OpenResty. Registration was performed through 1API GmbH and the domain uses Cloudflare nameservers (woz.ns.cloudflare.com, sara.ns.cloudflare.com). Reputation data indicates a Gridinsoft trust score of 0/100, placement on a single security blocklist, and a block by PhishDestroy. VirusTotal scans show eight of ninety‑three scanners flagging the domain as malicious. The combination of a low trust score, blocklist presence, and multi‑vendor detections suggests the domain is being used for malicious purposes, consistent with its classification as a generic phishing site. However, the exact payload or targeted brand cannot be confirmed because the page content has not been publicly disclosed beyond the generic title. Defenders should continue to block the domain at network perimeters, monitor DNS queries for the associated IPv6 address and Cloudflare nameservers, and consider adding the domain to internal blocklists. Ongoing observation is recommended to capture any future changes in content or additional threat intelligence.