enstart-io[.]ghost[.]io

The domain enstart-io.ghost.io was registered on February 21, 2026 through 1API GmbH and is currently active. DNS resolves to the IP address 151.101.3.7, which belongs to AS54113 Fastly, Inc. and is located in the United States. The authoritative nameservers are woz.ns.cloudflare.com and sara.ns.cloudflare.com, indicating use of Cloudflare’s DNS service.

Web traffic to the host returns an HTTP 301 redirect and presents a TLS certificate issued by Let’s Encrypt (R12). The landing page advertises itself with the title “Official Trezor™ Suite — Desktop & Web App for Hardware Wallets”, directly mimicking the legitimate brand’s product suite. Underlying server components identified are Varnish, Nginx, and OpenResty, a common stack for content‑delivery acceleration.

Reputation signals show the domain appears on one security blocklist and is listed by PhishDestroy as a cryptocurrency‑related impersonation of Trezor. The Gridinsoft trust score is 0 out of 100, reflecting extreme suspicion. VirusTotal analysis records four positive detections out of ninety‑five scanners, reinforcing the malicious classification. No additional public intelligence beyond these indicators is presently available.

Defenders should block network connections to 151.101.3.7 and add enstart-io.ghost.io to URL filtering rules. Email security gateways ought to flag any messages containing links to this host, especially those referencing Trezor or cryptocurrency transactions. Continuous monitoring of Fastly‑origin IP ranges for similar redirect patterns is advised, and incident response teams should treat any credential submissions to this site as compromised.