docsofficialtrezor[.]ghost[.]io

The domain docsoffionaltrezor.ghost.io is currently active and has been identified as a high‑risk brand‑impersonation infrastructure targeting Trezor users. DNS resolution points to IP 151.101.3.7, which belongs to AS54113 Fastly, Inc. and is geolocated in the United States. The host presents a valid Let's Encrypt certificate (R12) and is fronted by Varnish, Nginx, and OpenResty, indicating a typical content‑delivery configuration. The domain was created on 1 October 2011 and is delegated to Cloudflare nameservers woz.ns.cloudflare.com and sara.ns.cloudflare.com. HTTP requests receive a 301 redirect, and the page title reported is "docsofficialtrezor". Intelligence shows the site is listed on one security blocklist, has been blocked by PhishDestroy, and received detections from seven of ninety‑five VirusTotal scanners. The Gridinsoft trust score of 0/100 further suggests malicious intent, and the registration through 1API GmbH aligns with other observed cryptocurrency‑related scams. While the exact payload or phishing page content has not been captured, the convergence of domain age, hosting details, low trust score, and brand‑impersonation label provides sufficient confidence to treat the infrastructure as hostile. Defenders should immediately block the domain and its associated IP at network perimeters, add the domain to internal threat‑intel feeds, and monitor for any related C2 activity or credential‑harvesting attempts. Continuous re‑evaluation is advised in case additional indicators emerge.