gateway[.]ghost[.]io

Analysis indicates that gateway.ghost.io is an active infrastructure used to impersonate the Trezor hardware wallet brand. The domain was registered on 01 Oct 2011 through 1API GmbH and currently resolves to the IPv6 address 2a04:4e42:400::775, which belongs to AS54113 Fastly, Inc. in the United States. DNS resolution is served by Cloudflare nameservers woz.ns.cloudflare.com and sara.ns.cloudflare.com. HTTP requests receive a 301 redirect and the site presents a TLS certificate issued by Let's Encrypt (R12). Service fingerprinting shows a stack consisting of Varnish, Nginx and OpenResty, suggesting a typical content‑delivery configuration. Security‑vendor scans on VirusTotal report 5 detections out of 95 scanners, and the domain is listed on at least one public blocklist. Gridinsoft assigns a trust score of 0/100, and PhishDestroy has already blocked the domain. The page title returned is “gateway”, but no further content analysis is available. The evidence points to a high‑risk cryptocurrency‑related impersonation campaign targeting users of the Trezor brand. Uncertainty remains regarding the exact payload or credential‑harvesting mechanisms, as the site content has not been captured. Defenders should block outbound connections to 2a04:4e42:400::775 and add gateway.ghost.io to URL filtering and DNS sinkhole policies. Monitoring of TLS certificates issued by Let's Encrypt for this domain and continuous re‑scanning with multi‑engine services are recommended to detect any changes in the threat posture. Incident response teams should treat any user‑reported interactions with this domain as compromised and advise affected users to revoke any credentials that may have been submitted.