phamtom[.]lol

Phamtom.lol is a phishing domain that impersonates the popular Phantom Wallet, a cryptocurrency wallet service. This domain has been flagged as malicious by 11 out of 95 vendors on VirusTotal, indicating a significant threat level. Despite being taken down, its presence on public blocklists like PhishDestroy, MetaMask, and SEAL highlights its potential impact on users.

The domain was registered through PDR Ltd. and hosted by Cloudflare, Inc. in Canada. It was created on March 10, 2026, and PhishDestroy identified it as a threat by March 31, 2026. The quick detection underscores the effectiveness of PhishDestroy's early-warning systems, which operate upstream of traditional antivirus vendors. This allows for the identification of threats within the critical 24-72 hour window before they are widely recognized by AV databases.

With a platform risk score of 80 out of 100, phamtom.lol posed a high risk to users who might have been deceived into providing sensitive information under the guise of a legitimate service. The use of the name 'Phantom' in the domain and its page title 'Sandbox' suggests an attempt to lure users into a false sense of security. Although the site is currently offline, its initial ability to evade detection by many vendors highlights the ongoing challenges in combating phishing threats.