webpages[.]ghost[.]io

Analysis of the domain webpages.ghost.io indicates it was involved in a phishing campaign targeting users of Trezor cryptocurrency wallets, as evidenced by the page title 'Trezor Suite' observed in available metadata. The domain resolved to the IP address 98.84.224.111, hosted on Amazon.com, Inc. infrastructure (AS14618) in the United States. Infrastructure analysis reveals the use of Varnish, Nginx, and OpenResty technologies, which are commonly employed for web acceleration and reverse proxy services but are also utilized in malicious campaigns for traffic distribution and evasion. The domain was registered on February 21, 2026, through the registrar 1API GmbH and utilized Cloudflare nameservers (woz.ns.cloudflare.com and sara.ns.cloudflare.com), a configuration often seen in both legitimate and malicious operations for DNS management and DDoS protection. At the time of assessment, the domain returned an HTTP 404 status, suggesting it may have been taken offline or reconfigured following detection.

The SSL certificate was issued by Let's Encrypt (R12), a common certificate authority used across both benign and malicious sites. Detection data from security vendors shows that five out of ninety-three engines on VirusTotal flagged the domain as malicious, while it appeared on one security blocklist. The domain was specifically blocked by PhishDestroy, a specialized anti-phishing service. The combination of a cryptocurrency-related page title, detection by anti-phishing tools, and the use of hosting infrastructure frequently exploited for phishing campaigns supports the classification of this domain as part of a Trezor wallet phishing operation.

Defenders are advised to treat this domain as malicious and include it in blocklists for web filtering and email security gateways. Network security teams should monitor for connections to the associated IP address (98.84.224.111) and investigate any historical traffic to this domain within their environments.