officialus[.]ghost[.]io

The domain officialus.ghost.io has been identified as a generic phishing resource, currently classified as offline. Analysis indicates no specific brand impersonation; however, the domain exhibits characteristics consistent with credential harvesting or malicious redirect schemes. At the time of assessment, the page title displayed "Site unavailable," suggesting either temporary suspension or evasion tactics following detection. Infrastructure analysis reveals the domain was registered through 1API GmbH on February 21, 2026, an unusually future-dated creation that may indicate domain squatting or misconfigured records. It resolves to the IP address 104.21.20.33, hosted under AS13335 (Cloudflare, Inc.), a common proxy service leveraged to obscure origin infrastructure. The domain is flagged by 10 of 95 security vendors on VirusTotal, with a single entry on the PhishDestroy blocklist. The SSL certificate, issued by Let's Encrypt (R12), provides baseline encryption but does not mitigate the underlying threat. Detection metrics and blocklist presence confirm elevated risk, though the domain's current offline status limits further behavioral analysis. Current findings indicate the domain has been taken offline, likely due to enforcement actions or operational suspension. Organizations are advised to maintain blocklist updates to prevent potential re-emergence. Network administrators should monitor for connections to 104.21.20.33 and associated subdomains under ghost.io, as these may resurface in future campaigns. End-users should exercise caution with domains registered via 1API GmbH exhibiting similar patterns, particularly those leveraging Cloudflare for anonymization. Proactive DNS filtering and real-time threat intelligence integration are recommended to mitigate exposure to comparable phishing infrastructure.