enconnectwalt[.]ghost[.]io

The domain enconnectwalt.ghost.io is currently active and classified as a high‑risk brand‑impersonation campaign targeting the HTX brand. Technical inspection shows the site returns an HTTP 301 redirect and serves a valid Let’s Encrypt certificate (R12). The host resolves to IP 151.101.3.7, which belongs to AS54113 Fastly, Inc. in the United States. Infrastructure analysis reveals the presence of Varnish, Nginx and OpenResty, and the domain is delegated to Cloudflare nameservers woz.ns.cloudflare.com and sara.ns.cloudflare.com. Registration data indicates the domain was created on 01 Oct 2011 through the registrar 1API GmbH. Reputation signals include a Gridinsoft trust score of 0/100, placement on one security blocklist, and detection by three of ninety‑five VirusTotal scanners. The domain is also listed by PhishDestroy as blocked. While the page title "enconnectwalt" provides no further context, no additional content has been publicly disclosed. Defenders should block the domain at network perimeter and DNS layers, monitor for any HTX‑related credential submissions originating from the IP address, and update detection rules to flag traffic to the identified infrastructure components. Continuous re‑evaluation is advised as further indicators may emerge.