startas[.]ghost[.]io

This domain, startas.ghost.io, is identified as a brand impersonation threat targeting Trezor, a hardware wallet provider. The site mimics the Trezor Bridge interface, designed to establish a secure connection between hardware wallets and browsers. Analysis confirms the domain is currently offline, but prior activity suggests it was operational for credential harvesting or malware distribution. Infrastructure analysis reveals the domain was registered through Ghost on February 21, 2026, and resolved to the IP address 151.101.3.7, associated with AS54113 (Fastly, Inc.) in the United States. The SSL certificate was issued by Let's Encrypt (R12). The domain appears on one security blocklist and is flagged by 9 of 95 security vendors on VirusTotal. The page title, "Trezor Bridge: Secure Connection Between Your Hardware Wallet and Browser," directly mirrors legitimate Trezor communications, increasing the likelihood of successful social engineering. Current status indicates the domain has been taken offline, but residual risk remains for users who may have interacted with it prior to deactivation. Organizations and individuals are advised to block the domain and IP address at the network level, revoke any credentials or sessions associated with the site, and monitor for unauthorized access attempts. Users should verify the authenticity of Trezor-related communications by cross-referencing official sources and enable multi-factor authentication where available.