starti[.]ghost[.]io

The domain starti.ghost.io has been identified as a brand impersonation threat specifically targeting Trezor, a cryptocurrency hardware wallet provider. Analysis confirms the domain was designed to mimic the official Trezor Suite application, presenting itself as the "Official Crypto Management App." As of the latest assessment, the domain has been taken offline, though prior activity suggests a deliberate attempt to deceive users into disclosing sensitive credentials or installing malicious software. Infrastructure analysis reveals the domain was registered on February 21, 2026, through the Ghost platform, a service commonly used for content hosting. The domain resolved to the IP address 151.101.131.7, associated with AS54113 (Fastly, Inc.) in the United States. Security vendor assessments on VirusTotal indicate that 11 out of 95 engines flagged the domain as malicious, while it appears on at least one security blocklist. The SSL certificate was issued by Let's Encrypt (R12), a detail often exploited by threat actors to lend a false sense of legitimacy to phishing infrastructure. The page title, "Trezor Suite | Official Crypto Management App," further reinforces the impersonation attempt by closely mirroring the branding of the legitimate Trezor platform. Current status confirms the domain is offline, though the underlying infrastructure may remain accessible or repurposed for future campaigns. Organizations and individuals are advised to monitor for residual indicators of compromise, including the IP address 151.101.131.7 and associated domain patterns. Network defenders should update blocklists to include this domain and its resolved IP, while end-users should verify the authenticity of any Trezor-related communications by cross-referencing official sources. Cryptocurrency wallet holders are particularly urged to enable multi-factor authentication and avoid interacting with unsolicited links or downloads, even if they appear to originate from trusted brands.