siteplatform[.]ghost[.]io

This domain is flagged as a high-risk brand impersonation site targeting Trezor, a cryptocurrency hardware wallet provider. The page title is set to 'Trezor Suite', which matches the legitimate Trezor Suite interface used for managing crypto assets. The domain was created on October 1, 2011, and is registered through 1API GmbH, with nameservers hosted by Cloudflare (woz.ns.cloudflare.com and sara.ns.cloudflare.com). It resolves to IP address 108.138.36.21, located in Germany (DE) and hosted on Amazon Web Services (AS16509 Amazon.com, Inc.). The infrastructure uses Varnish, Nginx, and OpenResty technologies, with a 301 HTTP redirect in place. An SSL certificate issued by Let's Encrypt (R12) provides a false sense of legitimacy. VirusTotal reports 1 out of 95 security vendors flagging this domain, and it appears on one security blocklist (PhishDestroy). The Gridinsoft trust score is 0/100, indicating no trustworthiness. The scam type is confirmed as a crypto scam, specifically impersonating Trezor to likely harvest login credentials or seed phrases from victims. Defenders should block access to this domain, alert users to avoid entering any personal or financial information, and monitor for related subdomains or similar infrastructure. The exact tactics used on the page have not been visually verified, but the combination of high-risk indicators, brand impersonation, and active status warrants immediate action.