instructapt[.]ghost[.]io

The domain instructapt.ghost.io was registered on February 21, 2026 through the registrar 1API GmbH and is presently classified as a generic_phishing site with a high risk rating. The domain remains active as of July 12, 2026, and its public page title returns "Site unavailable" after an HTTP 301 redirect. The SSL certificate in use is issued by Let’s Encrypt (R12), indicating a freely‑available certificate that does not provide any assurance of legitimacy.

Infrastructure analysis shows that the domain resolves to the IP address 151.101.195.7, which belongs to AS54113 Fastly, Inc., a well‑known content delivery network located in the United States. DNS resolution is handled by the Cloudflare nameservers woz.ns.cloudflare.com and sara.ns.cloudflare.com, suggesting the operator is leveraging Cloudflare’s DNS and edge services. Web server fingerprints identify Varnish, Nginx, and OpenResty components, a stack commonly employed to accelerate content delivery and obscure backend details.

Threat intelligence flags the domain on a single security blocklist and records that PhishDestroy has already blocked it. VirusTotal scans report that 8 out of 95 security vendors flag the domain as malicious, and Gridinsoft assigns a trust score of 0 out of 100, reinforcing the suspicion of malicious activity. The combination of a low trust score, partial vendor detection, and inclusion on a phishing blocklist aligns with the high‑risk generic phishing designation.

Defenders should prioritize immediate containment of traffic to instructapt.ghost.io by adding the domain to network and endpoint blocklists. Continuous monitoring of the associated IP address and its Fastly ASN is advised, as the CDN could be reused for other malicious campaigns. Analysts should also watch for any changes in DNS resolution or certificate renewal that might indicate a shift in infrastructure, and consider sinkholing the domain to gather additional telemetry on victim interaction attempts.