aiddesk[.]ghost[.]io

The domain aiddesk.ghost.io was registered on 21 February 2026 and is currently classified as a high‑risk generic phishing site. The page title returned by the HTTP request is “Site unavailable”, and the host returns an HTTP 301 redirect. The domain is actively listed on at least one security blocklist and has been flagged by PhishDestroy. VirusTotal analysis shows that 4 of 95 security vendors have raised detections against the host.

Infrastructure analysis shows that the domain resolves to the IP address 151.101.131.7, which belongs to AS54113 Fastly, Inc. in the United States. The authoritative nameserver is ghost.map.fastly.net, indicating that the site is served through Fastly’s edge network. The TLS certificate is issued by Let’s Encrypt (R12), confirming the use of a free, automated certificate authority. Web server fingerprinting identifies Varnish, Nginx and OpenResty components, a common stack for fast content delivery.

The low Gridinsoft trust score of 0 out of 100 further suggests malicious intent, though the site’s visible content has not been captured beyond the generic title. No additional intelligence about the specific phishing payload, targeted brand, or victim interaction is available at this time. The limited detection count (four vendors) implies that many scanning engines have not yet observed malicious activity, which may reflect recent deployment or evasion techniques.

Defenders should block the domain aiddesk.ghost.io at network perimeter and add the associated IP 151.101.131.7 to deny lists. Continuous monitoring of the Fastly edge address range is advised, as the attacker could shift to adjacent IPs under the same ASN. Updating URL filtering and email security policies to flag redirects to this domain will reduce exposure. Organizations should also share any new observations with threat‑intel communities to improve collective detection.