webportal[.]ghost[.]io

PhishDestroy has identified webportal.ghost.io as a confirmed phishing domain engaged in brand impersonation targeting the Ethereum ecosystem. The site masquerades as the Official Trezor™ Suite, a legitimate hardware wallet interface, to trick users into connecting their wallets and ultimately drain their cryptocurrency. This threat type is classified as brand_impersonation with a crypto drainer kit, posing a significant risk to Ethereum holders.

Technical analysis reveals several critical indicators of malicious intent. The domain resolves to IP address 151.101.195.7 and was registered through 1API GmbH, with a creation date of October 1, 2011. Despite its age, the site is flagged by 13 out of 95 security vendors on VirusTotal, and it appears on one security blocklist. The SSL certificate is issued by Let's Encrypt (R12), which is commonly abused by phishing sites due to its free and automated issuance process.

As of the latest analysis, the domain has been taken offline, mitigating immediate risk. However, users should remain vigilant as similar domains may appear. PhishDestroy recommends never entering sensitive information on sites accessed via unsolicited links, and always verifying the authenticity of crypto platforms by visiting official URLs directly. For further protection, use PhishDestroy's verification tools to check suspicious domains before interacting with them.