serviceplatform[.]ghost[.]io

Analysis of serviceplatform.ghost.io shows it is an active brand‑impersonation infrastructure targeting the Ethereum ecosystem. The domain was registered on October 01 2011 through the registrar 1API GmbH and resolves to the IPv6 address 2a04:4e42:200::775, which is announced by AS54113 Fastly, Inc. in the United States. The site presents an HTTP 301 redirect and serves content over a Let’s Encrypt R12 TLS certificate, indicating recent certificate renewal. Header inspection reveals the web stack is built on Varnish, Nginx and OpenResty, a common combination for high‑performance front‑ends.

The page title returned from the redirect is “Trézor Suite® | Getting Started | TreZor® (Official)”, a credential‑management product unrelated to Ethereum, suggesting the page is being used as a lure for cryptocurrency‑related victims. Gridinsoft assigns a trust score of 0 out of 100, reflecting a high confidence of malicious intent. VirusTotal scans report that four of ninety‑three security vendors flag the domain as malicious, and the site is listed on one external security blocklist. Independent abuse‑mitigation service PhishDestroy has already blocked the host.

The nameservers are hosted by Cloudflare (sara.ns.cloudflare.com, woz.ns.cloudflare.com), a common choice for fast‑flux or resilient phishing operators. While the exact phishing page layout has not been publicly disclosed, the convergence of a low trust score, cryptocurrency‑scam classification, Ethereum impersonation, and active blocklist listings provides sufficient evidence for remediation. Defenders should block the domain at network perimeter, update DNS filtering to include the IPv6 address, monitor for any traffic to the associated Fastly ASN, and consider adding the host to internal blacklists. Ongoing surveillance is advised to detect potential repurposing or additional payloads.