phantom-wallet[.]blogspot[.]no

The domain phantom-wallet.blogspot.no is currently flagged as a high‑risk brand‑impersonation site targeting the Phantom cryptocurrency wallet brand. Registration data shows the domain was created on April 09, 2013 and is managed through MarkMonitor, Inc., a registrar commonly used by legitimate enterprises. DNS resolution returns the IPv6 address 2a00:1450:4001:805::2001, which belongs to AS15169 Google LLC and is geolocated to Germany. The hosting infrastructure therefore leverages Google's global network, and the TLS certificate presented is issued by Google Trust Services under the WE2 intermediate, indicating a valid certificate chain for the hosting provider but not for the malicious content itself. An HTTP 302 response is observed, suggesting a redirection mechanism that may forward visitors to additional malicious resources.

The site is built on Blogger and incorporates Java, Python, OpenGSE, and HTTP/3, all of which are typical of legitimate Google‑hosted blogs, complicating automated detection. The page title "Phantom Wallet - A friendly Crypto Wallet" directly references the targeted brand and aligns with the declared scam type of a crypto scam. VirusTotal analysis shows that 12 out of 93 security vendors have flagged the domain, reinforcing the suspicion of malicious activity. The domain is listed on a single external blocklist and has been actively blocked by PhishDestroy, indicating that some defensive feeds already recognize the threat. No public evidence of the exact phishing payload or credential‑harvesting page has been disclosed, leaving the specific user‑facing mechanisms uncertain.

Defenders should treat any traffic to this domain as hostile. Immediate mitigation steps include blocking the domain at the DNS resolver level, adding the IPv6 address to network‑level deny lists, and updating web‑filtering rules to drop HTTP 302 redirects to this host.