createwebsite[.]ghost[.]io

Analysis of createwebsite.ghost.io, observed on July 23, 2026, shows a high‑risk brand‑impersonation campaign targeting Trezor users. The domain, registered through 1API GmbH and created on October 01, 2011, resolves to IP address 172.66.45.31, which is owned by Cloudflare (AS13335) and located in the United States. DNS resolution uses Cloudflare name servers woz.ns.cloudflare.com and sara.ns.cloudflare.com, and the web server returns an HTTP 301 redirect. The site presents the page title "Trezor Suite" and presents a crypto‑scam profile, as indicated by the supplied scam type. Technical fingerprints reveal Varnish, Nginx, and OpenResty in the stack, and the site is protected by a Let’s Encrypt R12 certificate.

Reputation metrics are extremely low, with Scamadviser scoring 1/100 and Gridinsoft rating 0/100. The domain appears on four security blocklists—PhishDestroy, Polkadot, Enkrypt, and Codeesura—demonstrating that multiple threat‑intelligence feeds have flagged it. Google Safe Browsing marks the site for social engineering, and VirusTotal reports 14 of 95 scanning engines flagging the domain as malicious, reinforcing the classification as a crypto‑related phishing vector.

While the page title suggests an attempt to mimic the official Trezor Suite interface, no additional content analysis is available, leaving the exact payload or credential‑harvesting mechanisms unconfirmed. Defenders should immediately block traffic to createwebsite.ghost.io at network perimeters, update URL filtering lists with the domain, and monitor for related indicators such as the Cloudflare IP address and associated name servers. Users of Trezor products should be warned against visiting unsolicited links that reference "Trezor Suite" and instructed to verify URLs against the official Trezor domain. Continuous observation of the domain’s activity is recommended, as the infrastructure could be leveraged for further phishing or malware distribution.