Is ghosts-wallet.xyz a scam? TrustSniffer's high-risk assessment: 10/100

Security Alert

Fortinet flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

This is a recently launched website on the ghosts-wallet.xyz domain. Its name suggests a cryptocurrency wallet service. When it was assessed, it presented visitors with a security interstitial instead of its own content, titled "Suspected Phishing" and issued from its content-delivery provider. Its apparent purpose is account or wallet onboarding, but the site's actual product, operator and business model could not be established from the content captured.

Scam/Impersonation Risk

Contradictory signals are present, and they are decisive. The domain is blacklisted by external threat-intelligence sources, and at least one major security vendor flags it, with further vendors rating it suspicious. The page returned to the automated visit was a phishing-warning interstitial from the site's own CDN, which blocked access with a challenge response. Sandbox behaviour added secondary concerns. Nearly all of the site's network activity went to external hosts, mostly background data requests and several outbound POST submissions. Page-structure changes after interaction were extreme, and the browser logged many console errors. None of these on its own proves malicious intent. Together with the blacklisting and the wallet-themed name on a days-old domain, they match the profile of a short-lived credential- or wallet-harvesting front. No conflicting legal identities or confirmed brand impersonation were observed, because no identity content could be read. Absent on-page evidence, the cause of the listing, whether deliberate operation or compromise, cannot be determined, so the cautionary posture rests on the listing and the domain's profile. Evidence:

• Homepage: access was blocked by a bot challenge (HTTP 403), and the page title read "Suspected Phishing | Cloudflare".
• Domain provenance: registered 2026-10-13 (about 8 days old), with a single web-archive snapshot dated 2026-10-13 (first and last seen the same day, 1 year tracked).
• Behavioural sandbox, 3 runs: 57 external data requests and 9 external POSTs, about 95% of activity directed externally, 1,523 page mutations after interaction, and 21 console errors.
• External reputation: blacklist hit confirmed, with 2 additional vendors rating the domain suspicious.

Regulatory Verification Notes

No licensing, registration or legal-entity information could be read from the site. No legal, terms or about pages were captured, because the challenge page replaced the content. Ownership and governance are opaque, with incomplete registrant details behind a domain registered through NICENIC International Group. The site shows no regulated status. No broker-reputation record matched. This gap is a verification matter and not proof of wrongdoing, but the cautionary posture here rests on the confirmed blacklisting and the domain's age, and the missing disclosures make that posture harder to rebut. Any financial or custody service of the kind the name implies would normally be expected to disclose its operator and regulatory standing, and nothing of the sort is available here. Evidence:

• Registrar: NICENIC International Group Co., Limited; registration runs to 2027-10-13, a single one-year term.
• TLS certificate: DV (domain-validated only) issued by YE2, valid to 2027-01-11, so it confirms domain control and nothing about the operator.
• Hosting: served from AS13335 (Cloudflare, Inc., US).
• Legal and identity pages: none could be captured, so no entity, licence or registration number is attributable.

What to Verify Next

Any reasoning about this site should start from the blacklist listing and not from its appearance. Before any interaction, the listing should be re-checked against the major reputation services to see whether it persists. The operator's claimed identity should be confirmed through an independent, offline route, such as a registry lookup or a known official channel, and not through contact details on the site. If the site purports to represent an existing wallet or exchange brand, the brand's official domain should be checked directly, and this domain should be treated as unrelated until shown otherwise. Official support and contact channels should be confirmed only via those independent sources. Evidence:

• Listing status: the external blacklist hit and the vendor flag are current as of this assessment.
• Domain age: about 8 days since registration, with no established history to corroborate any claimed brand.
• Page access: the content was withheld behind a phishing-warning challenge, so no on-site claim could be tested.

Summary Verdict

The available evidence supports an elevated-risk, clearly cautionary classification. A confirmed external blacklisting, a very newly created domain, and risk-relevant behavioural traces converge in the same direction. The valid certificate and recognisable infrastructure do not offset these concerns. Real-world operator identity remains unverified, and no evidence provides a basis for legitimacy.

Infrastructure Integrity

The site sits behind Cloudflare's CDN and WAF. All four observed addresses, across IPv4 and IPv6, are CDN edge servers, so the origin server is not visible and the hosting cannot be independently attributed. The TLS certificate is valid with a known issuer. This is a mitigating factor only. The edge layer cannot be used to verify the operator, and it is what presented the phishing warning. It cannot offset the reputation risk. Infrastructure heuristics also flagged the domain's youth and sparse subdomain footprint, which are unconfirmed and secondary.

Closing Assessment

The site should be treated as unsafe for login, credential entry, wallet connection or any financial interaction, and at most viewed passively. No seed phrases, private keys, passwords or funds should be entrusted to it, and nothing should be downloaded from it. Anyone who has already interacted with it should treat any exposed credentials or wallet permissions as compromised and rotate them or revoke the access.