createstared[.]ghost[.]io

As of July 12, 2026, the domain createstared.ghost.io is flagged as a high-risk brand impersonation campaign. The domain impersonates Trezor, a well-known hardware wallet provider, and employs a misleading page title: 'Trezor™ Suite — Official Desktop & Web App for Hardware Wallets™'. This title is designed to deceive users into believing they are accessing the legitimate Trezor Suite, which could lead to compromising sensitive information or financial loss. Infrastructure analysis reveals that the domain is hosted on a server in the United States, with an IP address of 151.101.67.7, which is associated with AS54113, Fastly, Inc. The use of reputable technologies such as Varnish, Nginx, and OpenResty suggests a sophisticated setup, potentially aimed at evading detection and enhancing the credibility of the phishing site. The SSL certificate, issued by Let's Encrypt, further adds to the site's appearance of legitimacy, making it more challenging for users to identify the fraudulent nature of the domain. Despite these efforts, the domain has been blocked by PhishDestroy and appears on one security blocklist, indicating that security researchers and vendors have identified the threat. The domain's trust score from Gridinsoft is 0/100, underscoring the high risk associated with this impersonation attempt. While 3 out of 95 security vendors have flagged the domain on VirusTotal, this relatively low detection rate highlights the importance of continuous monitoring and proactive security measures. Defenders should update their blocklists to include this domain and educate users on the risks of visiting unauthorized sites that mimic trusted brands. Additionally, monitoring for similar domain registrations and IP addresses associated with Fastly, Inc. could help in identifying related phishing campaigns.