p-phantomwallet[.]us

p-phantomwallet.us entered the PhishDestroy evidence set on Sep 7, 2025. The hostname explicitly references Phantom; stored content metadata identifies the same apparent target. Content analysis also recorded brand signals for Ethereum, Facebook, Instagram, Polygon, Solana, and WhatsApp. The stored content classification is crypto scam. The assembled evidence scores 95/100 (critical).

Two independent sources are positive: VirusTotal and URLQuery. VirusTotal recorded 16 detections among 95 engines: ADMINUSLabs, ChainPatrol, alphaMountain.ai, BitDefender, Chong Lua Dao, CyRadar, ESET, Forcepoint ThreatSeeker, Fortinet, G-Data, Kaspersky, Lionic, Seclookup, Sophos, VIPRE, Webroot on Feb 23, 2026 at 05:29 UTC. URLQuery recorded 100 detections. The evidence is not unanimous. The external blocklist snapshot contained no matches on Aug 7, 2026 at 14:20 UTC. Google Safe Browsing returned no flag on Mar 3, 2026 at 04:14 UTC. URLScan completed without a malicious verdict (score 0) on Mar 5, 2026 at 22:24 UTC. PhishStats returned no feed match on Mar 2, 2026 at 18:06 UTC.

HTTP 502 was recorded on Aug 7, 2026 at 01:21 UTC; content was unavailable. Registration records for the domain list ENOM, INC. as the registrar and Sep 4, 2025 as the creation date. Registration preceded first observation by 2 days. At collection time, the hostname resolved to 142.11.248.171 on AS54290 (HOSTWINDS, US). The associated network metadata labels the endpoint as AS54290 Hostwinds LLC. in Dallas, US. The stored server header is LiteSpeed. Captured page title: “Phantom Wallet - Download Best Crypto Wallet - Phantom Wallet”. DOM analysis completed on Mar 24, 2026 at 05:24 UTC; stored DOM score 10/100. The evidence archive retains 2 visual captures from PhishDestroy and URLScan. IoC extraction completed on Aug 3, 2026 at 04:01 UTC; stored 0 format-validated wallet addresses and 0 Telegram indicators.

Taken together, the page content and independent findings support classifying this hostname as Phantom-themed crypto scam.