ghostrade[.]xyz

As of July 23, 2026, the domain ghostrade.xyz has been confirmed as a crypto scam impersonating the brand Hyperliquid. The site was taken offline, but the infrastructure and historical data provide substantial evidence of its malicious intent. The domain was registered on February 21, 2026, through NiceNIC International Group Co., Limited, and resolves to the IP address 172.67.167.15, which is located in the United States and is part of the Cloudflare, Inc. network (AS13335). The page title found was 'Rate Us - Hyperliquid,' which suggests an attempt to mimic the official Hyperliquid platform.

The domain has been flagged by several security vendors, including PhishDestroy, MetaMask, ScamSniffer, and SEAL, and appears on four security blocklists. The site has implemented technologies such as HSTS, Cloudflare Browser Insights, and HTTP/3, which can be used to enhance user trust but are often employed by malicious actors to appear legitimate. The SSL certificate is issued by Google Trust Services, which is a reputable provider, but this does not guarantee the site's safety. The domain is currently offline, and while this reduces the immediate risk, defenders should remain vigilant as the infrastructure and historical data indicate a significant threat.

Defenders are advised to block this domain at the network level and educate users about the risks of crypto scams impersonating well-known brands. The exact content of the site has not been analyzed, but the title and brand impersonation strongly suggest a targeted attack on Hyperliquid users. Further monitoring and analysis are recommended to ensure the domain does not reappear with similar malicious intent.