phantom-wallett[.]us

This domain, phantom-wallett.us, is identified as a brand impersonation threat targeting Phantom, a cryptocurrency wallet provider. Analysis indicates the site was designed to distribute counterfeit wallet software, likely aiming to harvest credentials or private keys from unsuspecting users. No drainer kit signatures were observed in available telemetry, though the infrastructure aligns with known phishing campaigns targeting cryptocurrency platforms. Infrastructure analysis reveals the following technical indicators: the domain was flagged by 12 out of 95 security vendors on VirusTotal, registered through NameSilo, LLC, and resolved to IP address 92.60.77.60 (AS214557, HOSTMENOW LTD, Netherlands). The domain was created on November 24, 2025, and currently lacks an SSL certificate. It appears on one security blocklist and was previously blocked by PhishDestroy. No entries were found in Google Safe Browsing at the time of analysis. The domain is currently offline, reducing immediate risk to users. However, the infrastructure remains registered and could be reactivated. Organizations should monitor for re-emergence on the same IP or registrar, and users who accessed the site prior to takedown should assume credential compromise. Security teams are advised to block the domain and IP at the perimeter and review logs for prior connections.