wlletdphantowm[.]gitbook[.]io

This domain, wlletdphantowm.gitbook.io, is actively flagged as a high-risk crypto wallet phishing site impersonating Phantom, a multi-chain cryptocurrency and NFT wallet. Analysis indicates the domain was registered on February 21, 2026, through Cloudflare, Inc., and currently resolves to the IP address 172.64.147.209, hosted on Cloudflare’s network (AS13335). The page title explicitly references Phantom’s branding, including support for Solana and Ethereum blockchains, which aligns with the identified scam type: a crypto scam. The domain is listed on three security blocklists and is actively blocked by at least three vendors, including MetaMask and SEAL, suggesting broad recognition of its malicious intent. Infrastructure analysis reveals the use of Cloudflare’s CDN and HTTP/3 protocol, which may be leveraged to obscure the origin server and evade detection. The SSL certificate is issued by Google Trust Services (WE1), a common practice among phishing domains to appear legitimate. A 307 HTTP status code is observed, which could indicate a temporary redirect or an attempt to manipulate user traffic. While four of ninety-five security vendors on VirusTotal flag this domain, the absence of additional context limits further assessment of its detection efficacy. Defenders should treat this domain as an active threat targeting cryptocurrency users. Given its association with Cloudflare’s infrastructure and the lack of transparency regarding the backend hosting, network-level blocking of the IP 172.64.147.209 and domain-level filtering are recommended. The domain’s registration age (less than five months) and continued activity suggest it remains part of an ongoing campaign. No evidence of takedown or remediation has been observed as of July 12, 2026. Further investigation into the redirect chain and backend infrastructure may provide additional indicators of compromise.