userconnect[.]ghost[.]io

The domain userconnect.ghost.io is flagged as a high‑risk generic phishing indicator and remains active as of July 12, 2026. It was registered on February 21, 2026 through 1API GmbH and uses Cloudflare nameservers (woz.ns.cloudflare.com, sara.ns.cloudflare.com). The site presents a TLS certificate from Let’s Encrypt (R12) and resolves to IP 151.101.67.7, which belongs to AS54113 Fastly, Inc. in the United States. HTTP analysis shows a 301 redirect, and the underlying stack includes Varnish, Nginx, and OpenResty. VirusTotal reports four of ninety‑three scanners flagging the domain, and it is currently blocked by PhishDestroy and listed on one external blocklist. Gridinsoft assigns a trust score of 0 out of 100, reinforcing the malicious assessment. The only visible page title is "Site unavailable," and no further content has been captured, leaving the specific phishing payload or target unknown. Defenders should treat the domain as malicious, enforce network‑level blocking, update intrusion‑prevention signatures, and monitor for any related infrastructure reuse. Continued observation of DNS and IP activity is advised to detect potential pivoting or replication of this campaign.