us-phantoum-wallet[.]pages[.]dev

On July 24, 2026 investigators recorded the domain us-phantoum-wallet.pages.dev as a high‑risk brand‑impersonation infrastructure targeting users of the Phantom cryptocurrency wallet. The domain was created on February 21, 2026 and is registered through Cloudflare, Inc., using the authoritative nameservers braden.ns.cloudflare.com and simone.ns.cloudflare.com. DNS resolution points to the IP address 172.66.47.164, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. The web server presents a TLS certificate issued by Google Trust Services under the WE1 label, and the site advertises HSTS, Cloudflare protection, and HTTP/3 support.

An HTTP request returns status code 403, and the page title returned by the server is "Phantom Wallet | Secure Multichain Wallet for Solana and Web3," directly mirroring the legitimate Phantom branding. Google Safe Browsing flags the domain for social engineering, and VirusTotal reports that 11 of 93 security vendors have flagged the host as malicious. The domain appears on one public security blocklist and is listed by PhishDestroy as a blocked indicator. Additional reputation data includes a Gridinsoft trust score of 0 out of 100, reinforcing the malicious assessment.

The observed activity aligns with a crypto‑scam classification, suggesting the operator intended to lure Phantom users into credential or private‑key theft. Although the site is currently taken offline, the infrastructure—particularly the Cloudflare‑hosted IP and the domain registration—remains observable and could be re‑activated. Defenders should add the domain and its resolving IP to blocklists, monitor for any re‑deployment of similar subdomains on the same Cloudflare account, and enforce endpoint protection that checks Google Safe Browsing and VirusTotal alerts for related indicators. Continuous threat‑intel sharing of the domain's identifiers will aid in rapid detection of any resurgence.