officialstarted-io[.]ghost[.]io

This domain, officialstarted-io.ghost.io, is flagged as an active high-risk phishing infrastructure specializing in brand impersonation. Registered on February 21, 2026, through 1API GmbH, the domain currently resolves to an IPv6 address (2a04:4e42:400::775) hosted on AS54113 (Fastly, Inc.) in the United States. Infrastructure analysis reveals the use of Cloudflare nameservers (woz.ns.cloudflare.com, sara.ns.cloudflare.com) and backend technologies including Varnish, Nginx, and OpenResty. The site returns an HTTP 301 redirect, though the destination remains unconfirmed, and its page title is listed as 'Site unavailable,' which may indicate temporary takedown measures or evasion tactics. Security vendors have detected malicious activity associated with this domain, with 4 of 93 engines on VirusTotal flagging it as suspicious. The domain appears on at least one security blocklist, and its SSL certificate is issued by Let's Encrypt (R12), a common choice for both legitimate and malicious sites. While the exact brand being impersonated is not specified in available data, the classification as 'brand impersonation' suggests it likely targets a well-known entity to deceive users. Defenders should treat this domain as active and high-risk. Network-level blocking is recommended, particularly for organizations that may be targeted by brand-impersonation campaigns. Further investigation into redirect chains and associated infrastructure may reveal additional compromised or malicious domains. Given the use of Cloudflare and Fastly, defenders should monitor for similar patterns in other phishing operations leveraging these services.