ghostenterprise[.]dat[.]ng

PhishDestroy identifies ghostenterprise.dat.ng as an active credential-harvesting impersonation targeting enterprise users. The domain mimics legitimate business services to trick visitors into submitting login credentials to a counterfeit portal, putting organizations at risk of account takeover and data exposure.

This domain, registered via a privacy-protected platform, resolves to IP 148.72.153.160 and holds a valid Let’s Encrypt SSL certificate. Security firm PhishLabs’ telemetry confirms it has been flagged by 2 of 95 VirusTotal vendors, indicating limited but credible detection. The domain appears to be recently deployed, with no historical reputation or positive trust indicators, and remains unblocked by major enterprise security platforms at this time.

Owing to its elevated threat profile and active campaigning, PhishDestroy advises immediate network-level blocking of ghostenterprise.dat.ng and its IP, 148.72.153.160. Security teams should audit DNS logs for recent queries and proactively alert users about this campaign via phishing awareness training. Given the use of a legitimate-looking SSL certificate and likely brand impersonation, this domain poses a high risk of successful infiltration and should be treated as a priority block in email security gateways and web filtering policies.