eng-webstart[.]ghost[.]io

Analysis of the domain eng-webstart.ghost.io indicates active credential-phishing infrastructure as of July 12, 2026. The domain, registered on February 21, 2026, through 1API GmbH, currently resolves to IPv6 address 2a04:4e42:600::775, hosted on AS54113 (Fastly, Inc.) in the United States. Infrastructure analysis reveals the use of Varnish, Nginx, and OpenResty, with a Let's Encrypt SSL certificate (R12) deployed. The domain's nameservers are woz.ns.cloudflare.com and sara.ns.cloudflare.com, a configuration consistent with bulletproof or abused hosting setups. The site returns an HTTP 301 redirect, suggesting it may be part of a larger redirection chain leading to a phishing landing page. The page title 'Site unavailable' does not provide definitive evidence of the targeted brand or service, and no specific scam category (e.g., banking, corporate login, crypto) has been confirmed. However, the domain appears on one security blocklist, and two of 93 security vendors on VirusTotal have flagged it, corroborating its malicious classification. Defenders should treat this domain as high-risk. The combination of Cloudflare nameservers, Fastly hosting, and a 301 redirect pattern is frequently observed in phishing campaigns designed to evade detection. While the exact content of the phishing page remains unanalyzed, the infrastructure and detection data justify immediate blocking at the DNS or network level. Further investigation into associated IP ranges and redirect chains is recommended to identify linked malicious domains.