downloadsapp[.]ghost[.]io

The domain downloadsapp.ghost.io was identified as a phishing site engaged in brand impersonation targeting Trezor, a cryptocurrency hardware wallet provider. This site posed as the 'Official Trezor™ Suite — Desktop & Web App for Hardware Wallets' to deceive users into interacting with fraudulent cryptocurrency services. No drainer kit was detected, but the site was classified as a cryptocurrency scam. As of the latest verification, downloadsapp.ghost.io has been taken offline.

Technical indicators confirm the elevated risk level of downloadsapp.ghost.io. The domain was flagged by 2 of 95 security vendors on VirusTotal, including CRDF and Gridinsoft, and appeared on 1 security blocklist (PhishDestroy). It was registered through 1API GmbH on October 01, 2011, and resolved to the IP address 151.101.131.7, hosted by Fastly, Inc. in the US. The SSL certificate was issued by Let's Encrypt (R12), and the site employed technologies such as Varnish, Nginx, and OpenResty. Nameservers were sara.ns.cloudflare.com and woz.ns.cloudflare.com, and the HTTP status returned a 404 error at the time of assessment.

Users who interacted with downloadsapp.ghost.io should immediately revoke any token approvals granted to unknown or suspicious contracts and transfer funds to a new, secure wallet. If credentials were entered, change passwords for all associated accounts and enable two-factor authentication (2FA). Report the phishing domain to platforms such as Google Safe Browsing, PhishTank, or the impersonated brand’s security team (Trezor) to aid in mitigation efforts.