webstartapp[.]ghost[.]io

Analysis indicates that the domain webstartapp.ghost.io is actively associated with credential phishing activity, as classified by multiple threat intelligence sources. The domain resolves to the IP address 172.67.145.145, which is hosted on infrastructure belonging to AS13335, a network commonly utilized for content delivery and security services. Infrastructure analysis reveals the use of Varnish, Nginx, and OpenResty technologies, which are frequently employed in both legitimate and malicious web deployments to manage traffic and caching. The domain currently returns an HTTP 301 redirect status, suggesting it may be part of a larger redirection chain designed to obscure the final phishing endpoint. The domain was registered on February 21, 2026, through 1API GmbH, a registrar that has been observed in previous phishing campaigns. As of July 12, 2026, the domain remains active and is flagged by at least one security blocklist. Detection engines have identified the domain as malicious, with 10 out of 93 security vendors on a widely used scanning platform marking it as suspicious. The SSL certificate is issued by Let's Encrypt, a common certificate authority used in both benign and malicious contexts, and does not inherently indicate legitimacy. The domain's trust score is assessed at 0/100 by an independent security evaluation platform, further supporting its classification as high-risk. The page title, 'Site unavailable,' may indicate that the phishing content is either temporarily disabled, restricted by geolocation or access controls, or intended to mislead automated crawlers. No specific brand or service is named in the available metadata, and the exact nature of the phishing content remains unconfirmed. Defenders are advised to block traffic to this domain at the network level, monitor for related infrastructure (e.g., subdomains, linked IPs), and correlate logs for connections to 172.67.145.145 or the domain itself.