officialsetup[.]ghost[.]io

This domain, officialsetup.ghost.io, poses a direct threat as a brand impersonation site designed to deceive users into believing it is the official Trezor Suite desktop application for hardware wallets. The page title explicitly mimics the legitimate software, increasing the likelihood of successful social engineering attacks targeting cryptocurrency users. Analysis indicates the site likely functions as a crypto drainer, tricking victims into entering sensitive wallet credentials or recovery phrases, which are then harvested by threat actors for unauthorized fund transfers. Evidence supporting this assessment includes detection by 8 out of 95 security vendors on VirusTotal, with Google Safe Browsing flagging the domain for social engineering. The domain was registered through 1API GmbH on October 01, 2011, though the malicious activity appears to be a recent repurposing of an older domain. Infrastructure analysis reveals it resolves to IP address 151.101.195.7 and is currently listed on one security blocklist. Technologies detected on the server include Varnish, Nginx, and OpenResty, which are consistent with typical phishing infrastructure. The SSL certificate is issued by Let's Encrypt, a common choice for both legitimate and malicious sites due to its free and automated nature. Users who visited officialsetup.ghost.io should immediately cease all interaction with the site. If any credentials, recovery phrases, or private keys were entered, the affected cryptocurrency wallet should be considered compromised. Users are advised to transfer remaining funds to a new, secure wallet using a clean device and a verified installation of the official Trezor Suite software. Monitor all linked accounts for unauthorized transactions and enable multi-factor authentication where available. Report the incident to relevant security teams and consider submitting the domain to additional threat intelligence platforms to aid in broader detection efforts.