webtrack[.]ghost[.]io

This domain is flagged for elevated risk due to brand impersonation targeting cryptocurrency users. Analysis indicates the infrastructure was designed to mimic Trezor hardware wallet interfaces, specifically impersonating Bybit, a known cryptocurrency exchange. The threat type aligns with crypto drainer or credential harvesting schemes, where victims are tricked into entering sensitive wallet or exchange credentials into fraudulent interfaces. Infrastructure analysis reveals the domain webtrack.ghost.io was registered through 1API GmbH and resolves to the IP address 151.101.3.7. The domain was created on October 01, 2011, though recent malicious activity suggests compromise or repurposing. It appears on one security blocklist, and VirusTotal reports 9 out of 95 security vendors flagging the domain as malicious. The SSL certificate is issued by Let's Encrypt (R12), a common choice for both legitimate and malicious domains. The page title, 'Trezor™ Suite — Desktop & Web App for Hardware Wallet,' directly impersonates Trezor’s official branding, increasing the likelihood of successful social engineering. Mitigation steps for users and organizations include blocking the domain and associated IP at the network level. Cryptocurrency users should verify the authenticity of wallet interfaces by cross-referencing official sources and avoiding links from unsolicited communications. Security teams are advised to monitor for similar impersonation domains, particularly those mimicking hardware wallet providers or exchanges. If credentials were entered on this domain, immediate revocation and replacement of exposed keys or passwords is critical to prevent unauthorized access or asset theft.