homeapps[.]ghost[.]io

Analysis of homeapps.ghost.io, observed on July 25, 2026, shows an active infrastructure used to impersonate the hardware‑wallet brand Trezor in a crypto‑related scam. The domain resolves to IP address 35.157.26.135, which is registered to Amazon.com, Inc. (AS16509) and geolocated to Germany, indicating use of a major cloud provider for hosting. The site presents a TLS certificate issued by Let’s Encrypt (R12) and returns an HTTP 301 status, suggesting a permanent redirect to another resource that has not been captured in the available data. The page title returned by the HTTP response is "Connect & Unlock," a phrase that aligns with Trezor’s credential‑entry workflow and supports the claim of brand impersonation.

Technical fingerprinting identified Varnish, Nginx and OpenResty as the web stack, while the domain’s authoritative name servers are sara.ns.cloudflare.com and woz.ns.cloudflare.com, both Cloudflare‑operated. Registration details show the domain was created on October 01, 2011 and is registered through 1API GmbH. Reputation signals are strongly negative: Gridinsoft assigns a trust score of 0 / 100, the domain is listed on one security blocklist, and PhishDestroy has already blocked it. VirusTotal scans show three of ninety‑three security vendors flag the domain, confirming malicious activity despite limited vendor coverage.

Uncertainty remains regarding the exact landing page content, any additional payloads, and whether the redirect leads to a credential‑harvesting form or a cryptocurrency address collector, as no visual analysis is available. Defenders should immediately block DNS resolution for homeapps.ghost.io, add the IP 35.157.26.135 to network‑level deny lists, and enforce URL filtering rules that deny any HTTP(S) traffic to this host. Continuous monitoring of Cloudflare name‑server changes and the associated Amazon IP range is advised, as the adversary could migrate to adjacent addresses.