connect-1[.]ghost[.]io

This domain is flagged as a confirmed credential harvesting site targeting Curve, a financial services platform. Analysis indicates the threat type is brand impersonation with an elevated risk level, designed to deceive users into submitting sensitive banking credentials through fraudulent login portals. Infrastructure analysis reveals the domain connect-1.ghost.io was registered on October 01, 2011, through 1API GmbH and currently resolves to the IP address 151.101.3.7. Security vendor detection on VirusTotal shows 7 out of 95 engines flagging the domain, while it appears on one enterprise security blocklist. The domain has a Gridinsoft trust score of 0/100 and employs a Let's Encrypt SSL certificate. Detected technologies include Ghost, Node.js, Varnish, Nginx, Google Cloud, OpenResty, and Google Cloud Trace, with the page title set to 'connect.' The domain is currently offline but remains a documented threat. Mitigation steps for this specific threat type include immediate blocking of the domain and associated IP address 151.101.3.7 at the network perimeter. Security teams should update endpoint protection rules to flag any attempts to access this domain and monitor for credential reuse from affected users. Financial institutions should implement multi-factor authentication and educate users on recognizing brand impersonation tactics, particularly those mimicking login portals. Historical analysis of the domain's creation date suggests potential long-term abuse patterns, warranting continuous monitoring of related infrastructure.