trezor[.]ghost[.]io

The domain trezor.ghost.io is currently active and hosts a page titled "Trezor® Hardware Wallet — Quick Start & Login Guide," indicating a direct impersonation of the Trezor brand. Technical fingerprinting shows the site is served through a Fastly edge node (AS54113) located in the United States, resolving to IP 151.101.3.7. The web stack includes Varnish, Nginx, and OpenResty, and the TLS certificate is issued by Let’s Encrypt (R12). Registration metadata points to the SKYCA-3 registrar, also tied to ASN 54113. VirusTotal analysis reports four of ninety‑five scanners flagging the domain, and it appears on one external blocklist. HTTP responses return a 301 redirect, and the domain is already listed by PhishDestroy as blocked. Nameserver information is unavailable, and no direct content inspection beyond the page title has been performed, leaving the exact phishing mechanics unconfirmed. Defenders should prioritize blocking trezor.ghost.io at DNS and proxy layers, monitor traffic to the associated Fastly IP range for similar brand‑impersonation patterns, and incorporate the domain into endpoint and email security signatures. Continuous re‑evaluation is advised as additional intelligence, such as payload samples or user reports, becomes available.