globalapp[.]ghost[.]io

Analysis of globalapp.ghost.io indicates an active brand impersonation campaign targeting the Base brand. The domain was created on October 01, 2011 and is registered through 1API GmbH. DNS resolution points to IP address 151.101.3.7, which belongs to AS54113 Fastly, Inc. in the United States. The site presents an HTTP 301 redirect and serves content over TLS using a Let's Encrypt R12 certificate.

Infrastructure fingerprints reveal the presence of Varnish, Nginx, and OpenResty, while authoritative name servers are sara.ns.cloudflare.com and woz.ns.cloudflare.com. Gridinsoft assigns a trust score of 0 out of 100, and the domain appears on one known security blocklist. VirusTotal reports that nine of ninety‑three scanning engines flag the domain, reinforcing the malicious assessment. The page title "Official TreŻor™ Suite — Desktop & Web App for Hardware Wallets" aligns with the listed scam type of wallet/seed phishing, suggesting attempts to harvest cryptocurrency wallet seeds.

The domain is already blocked by PhishDestroy, but its hosting on a major CDN indicates potential for rapid redeployment. Current uncertainties include the exact payload delivered after the redirect and whether additional credential‑collection pages exist beyond the observed title. Defenders should continue to block the domain at perimeter firewalls and DNS resolvers, monitor the associated Fastly IP range for similar patterns, and consider adding the domain to internal threat intel feeds. Continuous observation of the TLS certificate and any changes to the underlying infrastructure is recommended to detect possible re‑hosting or domain‑fronting tactics.