startwelcome[.]ghost[.]io

This domain, startwelcome.ghost.io, is flagged as an active brand impersonation threat targeting Trezor, a cryptocurrency hardware wallet provider. Registered on February 21, 2026, through the Ghost platform, it remains operational as of July 12, 2026. The page title explicitly claims to be the official Trezor Suite desktop and web application, which is a deceptive tactic to harvest credentials or seed phrases from users seeking legitimate wallet management software. The domain resolves to IP address 151.101.3.7, which is part of AS54113 (Fastly, Inc.) and located in the United States. Infrastructure analysis reveals the use of Varnish, Nginx, and OpenResty technologies, along with a Let's Encrypt SSL certificate issued by R12, which provides HTTPS encryption that may lend a false sense of security to visitors. The nameservers are set to ghost.map.fastly.net, consistent with Ghost's hosting infrastructure. The domain appears on one security blocklist and is flagged by 2 out of 95 security vendors on VirusTotal, indicating moderate detection coverage. The Gridinsoft trust score is 0 out of 100, reflecting strong negative assessments from automated analysis. The HTTP status code 301 suggests a redirect is in place, likely to funnel traffic to the phishing page or to evade initial detection. What is uncertain is the specific landing page content after the redirect and whether the site actively collects credentials or distributes malware. Defenders should block access to this domain at the network level, update email security filters to prevent phishing links reaching users, and report the domain to Ghost's abuse team for takedown. Users who may have visited the site should be advised to change their Trezor-related passwords and enable two-factor authentication where possible, while monitoring accounts for unauthorized activity.