websuite[.]ghost[.]io

This domain, websuite.ghost.io, is currently flagged as a high-risk brand impersonation threat targeting Ethereum. The site uses the page title 'Trezor™ Suite — Desktop & Web App for Hardware Wallets', which suggests an attempt to deceive users into believing they are interacting with a legitimate Trezor hardware wallet service. Analysis indicates that the domain is still active and has been registered since October 1, 2011, through 1API GmbH. The domain resolves to an IP address (151.101.67.7) located in the United States, under the ASN of Fastly, Inc. Security vendors have flagged this domain, with 6 out of 93 vendors marking it as malicious on VirusTotal, and it appears on one security blocklist. The SSL certificate is issued by Let's Encrypt, and the site employs technologies such as Varnish, Nginx, and OpenResty. Google Safe Browsing has identified this domain as potentially engaging in social engineering. Defenders should be cautious and monitor traffic to this domain, as it poses a significant risk of crypto scams. Users are advised to verify the authenticity of any hardware wallet services they access and avoid providing sensitive information on this site.