phantromwallet[.]webflow[.]io

This domain, phantromwallet.webflow.io, presents a high-risk brand impersonation threat specifically targeting users of the Phantom cryptocurrency wallet. Analysis indicates the site mimics the legitimate Phantom interface, displaying the page title 'Phantom® Wallet - The friendly multichain wallet' to deceive visitors into entering sensitive credentials or approving malicious transactions. Such impersonation typically facilitates crypto drainer attacks, where unauthorized transfers of digital assets are executed once user credentials or session tokens are compromised. The domain’s infrastructure and design closely replicate the authentic service, increasing the likelihood of successful social engineering against unsuspecting users. Technical indicators confirm the malicious nature of this domain. VirusTotal detection metrics show 18 out of 95 security vendors flagging phantromwallet.webflow.io as malicious, a significant ratio for a domain hosted on a reputable content delivery network. The domain was originally created on May 08, 2013, though the subdomain appears to have been repurposed for this phishing campaign. It is currently registered through MarkMonitor, Inc., a registrar commonly associated with legitimate enterprises, which may have contributed to delayed detection. Infrastructure analysis reveals the domain resolves to the IP address 104.18.36.248, hosted on AS13335 (Cloudflare, Inc.), a network frequently leveraged by threat actors to obfuscate origins. The domain appears on three security blocklists, and its SSL certificate, issued by Google Trust Services (WE1), further mimics legitimate services to evade suspicion. Users who have interacted with phantromwallet.webflow.io are advised to take immediate remedial action. If credentials were entered, affected parties should revoke all active sessions and reset passwords for the legitimate Phantom wallet and any associated accounts. Any connected browser extensions or applications should be reviewed for unauthorized modifications. Cryptocurrency wallets should be audited for unexpected transactions, and remaining funds should be transferred to a new wallet with a fresh seed phrase. Monitoring for subsequent phishing attempts via email or messaging platforms is recommended, as threat actors may attempt follow-up attacks using harvested contact information. This domain has since been taken offline, but users should remain vigilant against similar impersonation schemes targeting cryptocurrency services.