faqconnectapp[.]ghost[.]io

The domain faqconnectapp.ghost.io has been identified as a brand impersonation threat specifically targeting Ethereum cryptocurrency users. Analysis confirms the site masquerades as the official Trezor wallet setup portal, presenting itself under the page title 'Trezor.io/Start® | Trezor Suite App (Official) | Trezor®.' This campaign is designed to deceive users into interacting with fraudulent wallet initialization processes, likely leading to unauthorized asset transfers. The domain is currently offline, though prior activity remains a documented risk. Infrastructure analysis reveals the domain was registered through 1API GmbH and resolves to the IP address 151.101.3.7. Detection metrics indicate elevated risk: the domain is flagged by 7 of 95 security vendors on VirusTotal, holds a Gridinsoft trust score of 0/100, and appears on one security blocklist. The domain was originally created on October 1, 2011, though the current malicious activity suggests compromise or repurposing of an older, legitimate domain. Technologies detected on the server include Varnish, Nginx, and OpenResty, with a Let's Encrypt SSL certificate providing HTTPS encryption—common in phishing sites to appear legitimate. Current status shows the domain has been taken offline, mitigating immediate user exposure. However, the infrastructure remains a latent risk, particularly if the domain is reactivated or repurposed. Users are advised to verify all cryptocurrency wallet interactions through official channels only, avoiding any third-party links or redirects. Security teams should monitor for related domains registered under the same registrar or resolving to the same IP range. Blocking the IP 151.101.3.7 and domains associated with 1API GmbH registrations may reduce exposure to similar campaigns. Cryptocurrency holders should enable hardware-based authentication and multi-signature protocols to mitigate unauthorized transaction risks.