fortune-phantom[.]net

This domain, fortune-phantom.net, is flagged as a brand impersonation phishing site targeting users of the Phantom cryptocurrency wallet. Analysis indicates the site mimics the official Phantom interface, likely designed to harvest login credentials, recovery phrases, or private keys from unsuspecting victims. The page title, "Fortune Phantom ™ | The Official Site 【UPDATED 2025】", explicitly attempts to deceive users by presenting itself as an updated, legitimate platform. No evidence of a drainer kit was observed, but the site’s infrastructure and impersonation tactics align with common crypto-phishing campaigns. Infrastructure analysis reveals multiple technical indicators of malicious activity. The domain was registered through MainReg INC on May 03, 2025, and resolves to the IP address 91.236.116.114, hosted under AS42237 (w1n ltd) in Sweden. VirusTotal detection shows 19 out of 95 security vendors flagging the domain as malicious, while it appears on one security blocklist. The domain lacks an SSL certificate, a red flag for user security, and was blocked by at least one anti-phishing system. Google Safe Browsing (GSB) status is not explicitly listed, but the domain’s offline status suggests prior detection and mitigation. As of the latest assessment, fortune-phantom.net has been taken offline, reducing immediate risk to users. However, residual threats remain, particularly for individuals who may have interacted with the domain before its deactivation. Organizations and users are advised to monitor for unauthorized transactions or credential misuse, especially if wallet details were entered on the site. Proactive measures include revoking access to any suspicious wallet connections, rotating passwords, and enabling multi-factor authentication where applicable. The domain’s registration under a privacy-protected registrar and its rapid takedown suggest potential for re-emergence under a similar or altered infrastructure, warranting continued vigilance.