userhome[.]ghost[.]io

The domain userhome.ghost.io was registered on February 21, 2026 through the registrar 1API GmbH. DNS resolution points to the IPv4 address 151.101.195.7, which is advertised as part of AS54113 Fastly, Inc. and geolocated to the United States. The authoritative name servers are woz.ns.cloudflare.com and sara.ns.cloudflare.com, indicating Cloudflare DNS services. HTTP requests receive a 301 redirect and the site presents a TLS certificate issued by Let’s Encrypt (R12), confirming the use of standard public‑key infrastructure. Service fingerprinting identifies Varnish, Nginx, and OpenResty in the web stack, suggesting a typical content‑delivery configuration.

Threat intelligence shows that the domain is currently listed on one public security blocklist and has been actively blocked by the PhishDestroy mitigation platform. VirusTotal analysis reports that 2 of 95 scanned security vendors flagged the domain, while the Gridinsoft trust score registers a zero out of one hundred, reinforcing the malicious assessment. The page title returned from the web server is "Site unavailable," and the domain’s status is marked as active, indicating that the underlying phishing infrastructure remains operational.

Defenders should prioritize immediate containment of traffic to userhome.ghost.io by adding the domain to deny‑list rules across perimeter firewalls, DNS filtering services, and endpoint protection suites. Given the shared hosting environment on the Fastly network, monitoring for additional malicious domains resolving to the same IP address is advisable. Continuous re‑evaluation of VirusTotal and other multi‑engine scanners is recommended to capture any change in detection ratios. Organizations should also consider disabling outbound connections to the identified IP range for non‑essential services pending further investigation.