learn[.]ghost[.]io

learn.ghost.io is an active domain registered through the Ghost registrar on 21 February 2026. The site resolves to IP 151.101.131.7, an address owned by AS54113 Fastly, Inc. in the United States, and uses the nameserver ghost.map.fastly.net. The TLS certificate is issued by Let’s Encrypt (R12) and the HTTP response returns a 301 redirect to a page titled “Download Trezor Suite | Official App for Trezor Wallets”. The content is classified as a crypto‑scam that impersonates the Trezor hardware‑wallet brand. Security tooling reports five detections out of ninety‑five vendors on VirusTotal, and the domain appears on one public blocklist. It has been blocked by PhishDestroy and receives a Gridinsoft trust score of 0/100. Infrastructure fingerprints show Varnish, Nginx and OpenResty components. Analysis indicates that the domain is being used to lure victims seeking the official Trezor Suite download, leveraging brand impersonation to facilitate cryptocurrency theft. No additional behavioral data such as login forms or payload delivery has been observed. Defenders should add the IP address 151.101.131.7 to deny‑list rules, monitor DNS queries for ghost.map.fastly.net, and ensure that security appliances flag any HTTP 301 redirects to this domain. Continuous re‑evaluation is recommended given the active status and the low trust score.