homeproject[.]ghost[.]io

homeproject.ghost.io is currently flagged as a high‑risk brand‑impersonation site targeting Ethereum. The domain resolves to a single IPv6 address (2a04:4e42:600::775) hosted in the United States under ASN 54113 (Fastly, Inc.). The page title returned by the HTTP 301 response is “Official Trézor Suite — Desktop & Web App for Hardware Wallets”, indicating a cryptocurrency‑related lure. VirusTotal has logged detections from 8 of 95 security vendors, and the domain appears on one public blocklist, with PhishDestroy already blocking it. The risk rating is high and the domain remains active as of the report date. Infrastructure analysis shows the domain uses Cloudflare nameservers woz.ns.cloudflare.com and sara.ns.cloudflare.com, and the web server stack reports Varnish, Nginx and OpenResty components. TLS is provided by a Let’s Encrypt certificate (R12), confirming the use of a free, automated PKI. Registration was performed through 1API GmbH, and the Gridinsoft trust score is 0 out of 100, further indicating malicious intent. The HTTP response code is a 301 redirect, which may be used to forward victims to additional malicious pages. No additional infrastructure such as CDN or secondary IPs is observed. Defenders should immediately block traffic to homeproject.ghost.io at both DNS and network layers, and add the IPv6 address 2a04:4e42:600::775 to deny lists. Continuous monitoring of the associated Cloudflare name servers is advised, as the attacker may pivot to new IPs while retaining the same domain. Because the site’s content has not been publicly captured, analysts should treat any interaction with the domain as potentially credential‑harvesting or malware‑delivery activity related to Ethereum. Updating endpoint protection with the latest indicators of compromise, including the domain name, IPv6 address, and observed TLS fingerprint, will reduce exposure. Ongoing intelligence collection is recommended to detect any future changes in hosting or page content.