supporthelp[.]ghost[.]io

The domain supporthelp.ghost.io has been identified as a high-risk brand impersonation site specifically targeting Coinbase users. This domain was flagged as a phishing threat and has since been taken offline. The page title, 'Trezor Suite Download - Official Software Distribution,' is a clear attempt to mislead users into downloading malicious software or entering sensitive credentials, effectively operating as a crypto drainer.

Technical analysis reveals that supporthelp.ghost.io was flagged by 12 out of 95 security vendors on VirusTotal, indicating widespread recognition of its malicious nature. The domain was registered through 1API GmbH and resolves to IP address 151.101.67.7. Despite being created on October 1, 2011, which might suggest a legitimate history, the domain's current activity is entirely fraudulent. It appears on three security blocklists and uses an SSL certificate from Let's Encrypt (R12), a free certificate authority often abused by phishing sites. These indicators collectively confirm the domain's role in a sophisticated impersonation campaign.

As the domain is now offline, the immediate threat is neutralized, but users should remain vigilant. PhishDestroy recommends that anyone who interacted with supporthelp.ghost.io, especially those who entered credentials or downloaded files, should change their passwords immediately and enable two-factor authentication on their Coinbase accounts. Always verify URLs by navigating directly to official websites like coinbase.com. For ongoing protection, use PhishDestroy's browser extension to detect and block such threats in real time.