eng-starts[.]ghost[.]io

The domain eng-starts.ghost.io has been identified as a brand impersonation threat targeting the Trezor brand. This domain is designed to deceive users by mimicking the official Trezor website, potentially leading to the theft of sensitive information or credentials.

Analysis indicates that eng-starts.ghost.io has been detected by 10 out of 95 security vendors on VirusTotal, suggesting a moderate level of recognition among security tools. The domain is registered through 1API GmbH and resolves to the IP address 151.101.3.7, which is located in the United States and is associated with AS54113 Fastly, Inc. The domain was created on February 21, 2026, and is currently listed on one security blocklist. The SSL certificate is issued by Let's Encrypt, indicating an attempt to appear more legitimate to potential victims.

The domain is currently offline, which suggests that it has been taken down or is no longer actively being used for malicious activities. However, the infrastructure and registration details remain a concern, as they could be reused for future attacks. It is recommended that security teams and users remain vigilant and continue to monitor for any resurgence of this domain or similar impersonation attempts. Additional measures such as updating security filters and educating users about the risks of brand impersonation can help mitigate potential threats.