appofficialstrezor[.]ghost[.]io

On July 24, 2026, the domain appofficialstrezor.ghost.io was identified as a high-risk brand impersonation domain targeting Trezor, a well-known hardware wallet brand. Analysis indicates that this domain is actively involved in crypto scams, posing a significant threat to users who might mistake it for the official Trezor site. The domain resolves to the IP address 151.101.67.7, which is hosted by Fastly, Inc. in the United States (AS54113). The site uses technologies such as Varnish, Nginx, and OpenResty, suggesting a sophisticated infrastructure. The domain is registered through 1API GmbH and was created on October 01, 2011, indicating a long-standing presence that could be leveraged for malicious activities.

The SSL certificate is issued by Let's Encrypt, which is a common choice for both legitimate and malicious sites. The HTTP status code 301 suggests that the domain is redirecting users to another location, potentially to a more harmful site. The page title 'Official Trezor Suite — Desktop & Web App for Hardware Wallets' is designed to mislead users into believing they are accessing the official Trezor suite. Trust scores from Scamadviser and Gridinsoft are extremely low at 1/100 and 0/100, respectively, further indicating the domain's malicious nature.

The domain appears on one security blocklist, specifically PhishDestroy, which has flagged it as a threat. While VirusTotal data is not provided, the low trust scores and the domain's active status in a crypto scam suggest that it should be treated with caution. Defenders should block this domain and educate users about the risks of visiting unofficial sites that impersonate trusted brands. Additionally, monitoring for any related domains or IP addresses is recommended to prevent further spread of the scam.