enus-user[.]ghost[.]io

This domain enus-user.ghost.io remains active under a generic_phishing classification rated high risk on the report date of July 12, 2026. Registration occurred on October 01, 2011 via 1API GmbH. The domain resolves to IP 151.101.3.7 and operates with an SSL certificate from Let's Encrypt. Detected technologies include Ghost, Node.js, Varnish, Nginx and OpenResty. The associated page title is listed as HOMEPAGE.USER. Infrastructure analysis reveals consistent use of these components without deviation noted in current records.

Gridinsoft assigns a trust score of 0/100 to the domain. It is blocked by PhishDestroy and BLP-Malware, appears on 2 security blocklists and receives flags from 6 out of 95 vendors on VirusTotal. These metrics align with the active status and high risk designation. The combination of low trust scoring, explicit blocks and partial vendor detections provides concrete indicators of malicious deployment rather than benign operation.

Exact site content and any hosted resources have not undergone direct examination, introducing uncertainty regarding operational specifics beyond the recorded page title and threat classification. No additional brand targeting, kit signatures or campaign linkages appear in the supplied intelligence. Registration age from 2011 does not contradict current activity patterns observed in 2026.

Defenders should incorporate the domain and IP 151.101.3.7 into network blocks and DNS filters immediately. Continuous monitoring for status changes, cross-reference against emerging blocklist updates and correlation with the listed technologies supports proactive containment. Review of internal logs for any resolution attempts to this domain enables identification of potential exposure events.