webpagetrezo[.]ghost[.]io

The domain webpagetrezo.ghost.io has been identified as a brand impersonation threat targeting Trezor, a well-known cryptocurrency hardware wallet. The threat poses a significant risk by mimicking the official Trezor Suite webpage, potentially leading to the compromise of user credentials and sensitive information.

Analysis indicates that webpagetrezo.ghost.io has a VirusTotal score of 6/95, suggesting that it is flagged by a notable number of security vendors. The domain was registered through 1API GmbH on October 01, 2011, and resolves to the IP address 151.101.131.7. The site uses an SSL certificate issued by Let's Encrypt, which is a common choice for legitimate and malicious sites alike. It appears on one security blocklist and has a Gridinsoft trust score of 0/100, indicating a complete lack of trustworthiness. The technologies detected on the site include Varnish, Nginx, and OpenResty, which are often used to enhance the performance and reliability of web applications.

The current status of the domain is offline, which suggests that it has been taken down or is no longer actively hosted. Despite this, the threat posed by the domain remains elevated due to its potential to deceive users who may still attempt to access it. Security measures such as blocking the domain through PhishDestroy and other security solutions are recommended to mitigate the risk. Users are advised to verify the URL and SSL certificate of the official Trezor site and to report any suspicious activity to their security teams. The remaining risk is considered moderate, as the domain could be reactivated or repurposed for future attacks.