treziostart[.]ghost[.]io

Analysis of the domain treziostart.ghost.io indicates active infrastructure impersonating the Trezor hardware wallet platform, specifically targeting Ethereum users. The page title, 'Official Trezor™ Suite — Desktop & Web App for Hardware Wallets,' directly mimics the legitimate Trezor brand, suggesting an intent to deceive users into interacting with fraudulent wallet management interfaces. As of July 12, 2026, the domain remains operational, resolving to an IPv6 address (2a04:4e42:400::775) hosted on AS54113 (Fastly, Inc.) in the United States. The site employs a 301 HTTP redirect, which may be used to funnel victims toward credential harvesting or malware distribution endpoints. Infrastructure analysis reveals the use of Varnish, Nginx, and OpenResty, technologies commonly associated with content delivery and reverse proxy setups, potentially obscuring backend malicious activity. The domain is proxied through Cloudflare nameservers (sara.ns.cloudflare.com and woz.ns.cloudflare.com), a tactic frequently observed in phishing campaigns to evade takedowns and mask origin servers. A Let's Encrypt SSL certificate (R12) is present, providing a veneer of legitimacy while failing to mitigate the underlying threat. Security vendor detections are mixed but notable: 14 of 93 engines on VirusTotal flag the domain, and Gridinsoft assigns a trust score of 0/100. The domain appears on at least one security blocklist, further corroborating its malicious classification. Registered through 1API GmbH on October 1, 2011, the domain's age contrasts with its recent malicious repurposing, a pattern observed in compromised or recycled infrastructure. Defenders should prioritize blocking this domain at the DNS and network levels, particularly in environments handling cryptocurrency transactions. Given the use of Cloudflare and Fastly, monitoring for related subdomains or IP shifts is recommended.