phntm-waletio[.]pages[.]dev

Analysis as of July 23 2026 indicates that the domain phntm-waletio.pages.dev is associated with a high‑risk brand‑impersonation campaign targeting Ethereum users. The site returned an HTTP 403 status code, and its page title was captured as “Phantom Wallet Explained: Easy Crypto Transactions Made Simple,” which aligns with the declared scam type of wallet/seed phishing. DNS resolution points to IP 172.66.47.49, an address owned by AS13335 Cloudflare, Inc. and geolocated to the United States. The domain is served through Cloudflare’s infrastructure, employing HSTS and HTTP/3, and uses a TLS certificate issued by Google Trust Services under the “WE1” label, confirming the use of a legitimate‑looking certificate chain. Nameservers arnold.ns.cloudflare.com and mary.ns.cloudflare.com further confirm Cloudflare as the registrar. Multiple defensive sources have flagged the domain.

Google Safe Browsing classifies it as a social‑engineering threat, and PhishDestroy has actively blocked access. VirusTotal reports that 11 of 95 scanned security vendors flagged the domain, while the Gridinsoft trust score is 0 / 100, indicating a high confidence of malicious intent. The domain appears on at least one security blocklist and has been included in a blocklist maintained by an unnamed security vendor. The domain was registered on February 21 2026 and is currently taken offline, which may be the result of takedown actions or automated sinkholing. While the observed evidence confirms the presence of a phishing infrastructure, certain aspects remain unknown.

No direct samples of the phishing payload, credential‑stealing forms, or malicious redirects have been captured, and the exact phishing kit or code reuse cannot be determined from the available data. The short lifespan of the domain suggests a fast‑flux or throwaway deployment strategy, typical of credential‑theft campaigns. Defenders should add phntm-waletio.pages.