newhometrzr[.]ghost[.]io

PhishDestroy has identified newhometrzr.ghost.io as a brand impersonation domain specifically targeting Ethereum users. The site posed as the official Trézor Suite, attempting to deceive visitors into believing it was the legitimate desktop and web application for hardware wallets. This type of threat often leads to credential theft or crypto drainer attacks, where users unknowingly connect their wallets or enter sensitive information.

Technical investigation reveals that the domain was registered through 1API GmbH and was created on October 01, 2011, giving it an aged appearance that malicious actors sometimes exploit to bypass automated checks. It resolved to the IP address 151.101.131.7 and used an SSL certificate from Let's Encrypt (R12), which is common among legitimate sites but also abused by phishers. VirusTotal analysis shows 0 out of 95 security vendors flagged the domain, indicating it was not widely detected before takedown. However, it appears on one security blocklist, suggesting early identification by some threat intelligence feeds.

As of now, newhometrzr.ghost.io has been taken offline, significantly reducing immediate risk. Users who may have visited the site should monitor their accounts and wallet activity for any unauthorized transactions. PhishDestroy recommends remaining vigilant against similar impersonation domains, especially those using typosquatting or seemingly legitimate subdomains. Always verify URLs directly and use bookmarks for sensitive services like cryptocurrency wallets.