phantianwallet[.]webflow[.]io

Analysis of the domain phantianwallet.webflow.io indicates it is currently active and associated with a crypto‑drainer campaign. The domain was registered through Webflow, Inc., a platform that provides hosted website services, and resolves to the IP address 172.64.151.8. No nameserver information is available, as the records return NS_NOT_FOUND.

The domain has been observed on a single security blocklist and is actively blocked by the PhishDestroy threat‑intel feed, suggesting that at least one defensive platform has identified malicious use. VirusTotal reports that the domain was scanned by 91 antivirus vendors, and none of the scanners raised a detection; however, the absence of detections does not constitute evidence of benign behavior and should not be interpreted as a safety guarantee. The available evidence does not include SSL certificate details, HTTP response codes, page title, or any explicit brand targeting, leaving those aspects of the infrastructure unverified.

Defenders should treat the domain as high‑risk for crypto‑draining activity, block network connections to the IP 172.64.151.8, and add the domain to URL filtering lists. Continuous monitoring for changes in DNS resolution, additional blocklist listings, or emergent detection signatures is recommended, as the current data set provides limited visibility into the full scope of the malicious infrastructure.