trezorio[.]ghost[.]io

This domain is flagged as an elevated-risk brand impersonation threat targeting Trezor, a cryptocurrency hardware wallet provider. Analysis indicates the site mimics Trezor Suite, the official wallet management interface, likely to harvest credentials or distribute crypto-draining malware. The page title "Welcome to Suite" directly aligns with Trezor's legitimate branding, increasing the likelihood of successful deception. Infrastructure analysis reveals the domain trezorio.ghost.io was registered through SKYCA-3 (ASN: 54113) and resolves to IP 172.66.45.10. Technologies detected include Varnish, Nginx, and OpenResty, suggesting a proxy or CDN-backed hosting environment. The SSL certificate is issued by Let's Encrypt, a common tactic to appear legitimate. Detection rates are low but notable: VirusTotal reports 2/95 security vendors flagging the domain, while Gridinsoft assigns a trust score of 0/100. The domain appears on two security blocklists and is actively blocked by PhishDestroy and Hagezi. Current status indicates the domain has been taken offline, though historical activity remains a concern. Mitigation steps for this specific threat type include immediate blocking of the domain and IP at firewall and DNS levels. Organizations should monitor for connections to 172.66.45.10 or requests to trezorio.ghost.io in network logs. Users who may have interacted with the site should be instructed to reset Trezor Suite credentials and enable multi-factor authentication where available. Cryptocurrency wallet holders should verify all transaction requests manually, as this domain likely aimed to facilitate unauthorized transfers. Security teams should review recent outbound connections to the IP and domain, particularly from systems handling crypto-related operations.