webpannel[.]ghost[.]io

Analysis of webpannel.ghost.io shows a high‑risk, active generic_phishing campaign. The domain was registered on February 21, 2026 through 1API GmbH and currently resolves to 151.101.195.7, an address owned by Fastly, Inc. in the United States (AS54113). DNS resolution is handled by Cloudflare nameservers woz.ns.cloudflare.com and sara.ns.cloudflare.com, and the site presents a Let's Encrypt R12 certificate. HTTP traffic returns a 301 redirect and the page title is "Site unavailable," indicating that the landing page content has not been captured. Infrastructure fingerprints include Varnish, Nginx, and OpenResty, suggesting a typical CDN‑backed web server stack. Security scoring from Gridinsoft is 0/100, and five of ninety‑three VirusTotal scanners have flagged the domain, while PhishDestroy has already added it to its blocklist and it appears on one additional security blocklist. No further intelligence on the phishing payload, targeted brands, or credential‑harvesting mechanisms is available at this time. Defenders should immediately block the domain and its associated IP address at perimeter and endpoint layers, monitor DNS queries for the domain and its nameservers, and consider sinkholing the IP range if feasible. Continuous threat‑intel feeds should be consulted for any updates on payload characteristics or victim reports, and any observed traffic should be logged for forensic correlation.