newdesktop[.]ghost[.]io

Analysis of newdesktop.ghost.io shows a high‑risk brand‑impersonation campaign targeting Trezor users. The domain, registered on October 01, 2011 through 1API GmbH, resolves to 151.101.3.7, an address owned by AS54113 Fastly, Inc. in the United States. HTTP requests receive a 301 redirect, and the site presents a TLS certificate issued by Let’s Encrypt (R12). Infrastructure profiling reveals Cloudflare authoritative nameservers (woz.ns.cloudflare.com, sara.ns.cloudflare.com) and a web stack composed of Varnish, Nginx and OpenResty. Gridinsoft assigns a trust score of 0/100, and VirusTotal reports that 10 of 95 scanning engines flag the domain as malicious. The page title returned is "newdesktop" and the domain appears on one security blocklist, currently blocked by PhishDestroy. While the exact phishing page content has not been captured, the combination of a crypto‑scam label, Trezor impersonation, and active malicious indicators suggests ongoing credential‑stealing activity. Defenders should block the domain at DNS and proxy layers, monitor outbound connections to the identified IP, and update detection rules to include the observed TLS fingerprint and server header signatures. Continuous re‑assessment is recommended, as additional malicious payloads may be deployed behind the existing redirect infrastructure.