explorweb[.]ghost[.]io

Analysis of explorweb.ghost.io indicates active generic phishing infrastructure as of July 24, 2026. The domain was created on October 01, 2011 and is registered through 1API GmbH. DNS resolution points to the IP address 151.101.3.7, which belongs to AS54113 Fastly, Inc. and is geolocated in the United States. The site serves an HTTP 301 redirect and presents the page title "Site unavailable".

TLS termination is performed by a Let’s Encrypt certificate (R12), and the web stack is identified as Varnish, Nginx and OpenResty, hosted behind Cloudflare nameservers sara.ns.cloudflare.com and woz.ns.cloudflare.com. Google Safe Browsing has flagged the domain for social engineering, and one external security blocklist, PhishDestroy, has listed it. VirusTotal reports five detections out of ninety‑five scanned vendors, confirming that multiple security products recognize malicious activity. Gridinsoft assigns a trust score of 0 out of 100, reflecting a lack of benign reputation.

While the exact phishing lures and targeted brands remain undisclosed, the combination of redirection, low trust score, and multiple vendor detections classifies the domain as high‑risk. Defenders should block the domain at perimeter and endpoint controls, monitor DNS queries for the associated IP and nameservers, and update web filtering rules to include the observed SSL fingerprint. Continuous re‑evaluation is advised, as further payload analysis may reveal additional indicators of compromise.