en-phantam[.]pages[.]dev

The domain en-phantam.pages.dev was created on 21 February 2026 and is hosted behind Cloudflare’s network (AS13335). DNS resolution points to IP 188.114.96.3, an address located in the United States and owned by Cloudflare, Inc. The domain uses Cloudflare‑managed nameservers (anton.ns.cloudflare.com and imani.ns.cloudflare.com) and presents a valid SSL certificate issued by Google Trust Services under the WE1 root. HTTP requests return a 403 status, indicating the site is currently taken offline. The page title retrieved from the live endpoint reads “Phantom Wallet | Secure Multichain Wallet for Solana and Web3,” which aligns with the classified scam type of wallet/seed phishing.

The threat is described as brand impersonation, targeting the Phantom wallet ecosystem across multiple platforms. Security telemetry shows the domain is listed on the PhishDestroy blocklist and has been flagged by two of ninety‑three VirusTotal scanners. Independent reputation scoring from Gridinsoft assigns a zero‑point trust rating (0/100). Detected infrastructure components include HSTS enforcement, HTTP/3 support, and Cloudflare security services.

While the site is presently inaccessible, the combination of a recent registration date, Cloudflare‑based hosting, a legitimate‑looking SSL certificate, and a targeted page title suggests a deliberate attempt to lure users into providing wallet credentials or seed phrases. Defensive teams should add en-phantam.pages.dev to network deny lists, monitor its IP address for any re‑activation, and inform end‑users that any unsolicited request for Phantom wallet secrets originating from this domain is malicious. Continuous observation of VirusTotal and other threat‑intel feeds is advised to capture any future activity associated with the same infrastructure.