phnttom-wallet-extension[.]webflow[.]io

Analysis of phnttom-wallet-extension.webflow.io shows a high‑risk crypto‑drainer infrastructure that is currently active. The domain is hosted on the Webflow platform, a legitimate site‑builder that is often abused for malicious purposes. It appears on three independent security blocklists, indicating that multiple threat‑intelligence feeds have flagged the address. In addition, three reputable protection services—PhishDestroy, MetaMask, and SEAL—have explicitly blocked the domain, suggesting that it is recognized as a vector for illicit wallet interactions or token theft.

VirusTotal has recorded detections from twelve out of ninety‑one scanned scanners, reinforcing the presence of malicious code or behavior. Google Safe Browsing classifies the site as a social‑engineering threat, which aligns with the observed intent to deceive users into authorizing crypto transactions. The available data do not disclose the underlying IP address, SSL certificate details, or HTTP response codes, leaving the exact hosting configuration unknown.

However, the convergence of blocklist entries, vendor detections, and safe‑browsing alerts provides a compelling evidence base that the domain is being used to lure victims into installing a fraudulent wallet extension or granting access to cryptocurrency assets. Defenders should immediately add the domain to DNS and proxy deny lists, enforce browser‑level warnings for any navigation attempts, and monitor for anomalous wallet‑interaction events on endpoints that may have previously accessed Webflow‑hosted content. Continuous telemetry collection on related hash values and network flows is recommended to capture any evolving payloads associated with this crypto‑drainer campaign.