appaccess[.]ghost[.]io

Analysis of the infrastructure associated with appaccess[.]ghost[.]io shows a clear pattern of abuse targeting the Trezor brand. The domain resolves to the IP address 63.176.8.218, which is allocated to Amazon.com, Inc. (AS16509) and geolocated to Germany. The hosting environment presents a typical web stack consisting of Varnish, Nginx and OpenResty, and the site is served over a Let’s Encrypt certificate (R12). DNS resolution is handled by Cloudflare nameservers sara.ns.cloudflare.com and woz.ns.cloudflare.com, indicating the use of a CDN for traffic obfuscation.

An HTTP 301 redirect is observed, and the page title returned by the server is "Connect & Unlock," a phrase commonly associated with cryptocurrency wallet access flows. The domain is registered through 1API GmbH and was created on 1 October 2011, suggesting a long‑standing registration that may have been repurposed for malicious activity. The site appears on a single security blocklist, PhishDestroy, which classifies it as a crypto‑related scam and explicitly notes impersonation of the Trezor brand. Independent reputation scoring from Gridinsoft assigns a trust score of 0 out of 100, reinforcing the malicious assessment.

VirusTotal reports that the domain has been scanned by 93 vendors, with no current detections; however, the absence of detections does not constitute evidence of safety and must be weighed against the other corroborating indicators. Defenders should block traffic to 63.176.8.218 and to the domain name itself at the DNS level, monitor for any related C2 communications originating from the same ASN, and consider sinkholing the IP range if feasible. Continuous re‑evaluation is advised, as the site remains active and may evolve its payload or delivery mechanisms.