Phishing sites impersonating Phantom

PhishDestroy has recorded 1,008 phishing domains impersonating Phantom since 2025-07-17, 27 of them in the last 30 days. The most used registrars are Cloudflare and MarkMonitor; the most common TLDs are .com and .dev. The official Phantom domain is phantom.com: any other site asking for your login or wallet is not Phantom.

1,008
Domains, all time
27
Last 30 days
364
Online at last check
187
Confirmed takedowns

New domains in the last 90 days

2026-07-25: 02026-07-26: 12026-07-27: 02026-07-28: 22026-07-29: 02026-07-30: 02026-07-31: 02026-08-01: 32026-08-02: 62026-08-03: 02026-08-04: 22026-08-05: 12026-08-06: 12026-08-07: 22026-08-08: 02026-08-09: 22026-08-10: 02026-08-11: 02026-08-12: 12026-08-13: 02026-08-14: 22026-08-15: 32026-08-16: 12026-08-17: 02026-08-18: 32026-08-19: 02026-08-20: 62026-08-21: 32026-08-22: 02026-08-23: 02026-08-24: 02026-08-25: 02026-08-26: 32026-08-27: 02026-08-28: 02026-08-29: 02026-08-30: 02026-08-31: 12026-09-01: 02026-09-02: 32026-09-03: 22026-09-04: 32026-09-05: 32026-09-06: 42026-09-07: 22026-09-08: 42026-09-09: 72026-09-10: 02026-09-11: 82026-09-12: 12026-09-13: 22026-09-14: 12026-09-15: 12026-09-16: 02026-09-17: 02026-09-18: 22026-09-19: 12026-09-20: 02026-09-21: 02026-09-22: 12026-09-23: 12026-09-24: 02026-09-25: 02026-09-26: 12026-09-27: 02026-09-28: 02026-09-29: 02026-09-30: 02026-10-01: 02026-10-02: 12026-10-03: 12026-10-04: 12026-10-05: 02026-10-06: 02026-10-07: 22026-10-08: 12026-10-09: 22026-10-10: 52026-10-11: 22026-10-12: 02026-10-13: 22026-10-14: 02026-10-15: 02026-10-16: 12026-10-17: 22026-10-18: 02026-10-19: 32026-10-20: 12026-10-21: 02026-10-22: 0
Phantom phishing domains detected per day: 114 from 2026-07-25 to 2026-10-22; peak 8.

How to tell a fake Phantom site

Official domains: phantom.com, phantom.app.

Words most often added to the brand in reported domains: wallet, phantomwalletdownload, phantomwallet, phantomeextensionn, wallett, phantomwalletextensiondownload, created, phntom, eng, typedream.

  • Type the address yourself or use a bookmark; phishing links for Phantom arrive through ads, search results, direct messages and fake support accounts.
  • Check the full domain before you sign in: look for extra words, hyphens, a different TLD or look-alike letters.
  • Phantom will never ask for your seed phrase. Read every wallet signature: approvals, Permit and setApprovalForAll requests can hand over your assets.

Paste a suspicious address into the Homoglyph Checker or check it against the DestroyList.

Latest Phantom phishing domains

The 50 most recently detected domains impersonating Phantom
DomainFirst detectedStatus at last checkRegistrar
whspr.finance2026-10-20OnlineNICENIC
app.phantomlocal.com2026-10-19OnlineGoDaddy.com
ccreator.io2026-10-19OfflineGoDaddy.com
tiers-velit.app2026-10-19OnlineNICENIC
yearofslu.com2026-10-17OnlineENOM
dk-phantom.ru2026-10-17Online—
trade-phantom.top2026-10-16UnknownNICENIC
phantomcard.live2026-10-13OnlineNameSilo
bentleytrikedirect.shop2026-10-13OfflineDynadot
bbalabs.shop2026-10-11OfflineDynadot
barnettcrossbowshunting.shop2026-10-11OnlineDynadot
gate-phantom.icu2026-10-10OfflineNICENIC
gatesolanaphantom.xyz2026-10-10UnknownNICENIC
bajaaoapp.shop2026-10-10OnlineSpaceship
bacsole.shop2026-10-10OnlineDynadot
baccafit.shop2026-10-10OnlineDynadot
unisport-phantom.app2026-10-09OnlineName.com
phantom.larpshop.cloud2026-10-09OfflineOVH
authenticatedhq.shop2026-10-08OnlineDynadot
humanpad.digital2026-10-07OnlineNICENIC
solperps.fun2026-10-07OnlineName.com
arenalaunch.fun2026-10-04OnlinePorkbun
eng-phantomwallet.com2026-10-03OnlineNICENIC
apolloscootersshop.shop2026-10-02OnlineDynadot
alcvinyledit.shop2026-09-26OfflineDynadot
phantom-plateau.com2026-09-23OnlineDynadot
web3phantom.cc2026-09-22OnlineGname.com
phantomchain.online2026-09-19OfflineNameCheap
mistclaw-phantom.com2026-09-18OnlinePorkbun
thunderbloom-phantom.com2026-09-18OnlinePorkbun
phantom-app-2mt.pages.dev2026-09-15OnlineCloudflare Pages
phantom-chat.pages.dev2026-09-14OnlineCloudFlare
phantom-wollwt-us.wasmer.app2026-09-13OfflineWasmer
phantomwallet-solana.godaddysites.com2026-09-13OnlineGoDaddy.com
phantom1-wallet.godaddysites.com2026-09-12OnlineGoDaddy Sites
fortunephantomai.com2026-09-11OnlineSav.com
verify-shield.online2026-09-11OfflineGoDaddy.com
phantomv2.pro2026-09-11OfflineHOSTINGER operations
phant-tomiowalet.gitbook.io2026-09-11OfflineCloudflare
stashphantom.cc2026-09-11OnlineSpaceship
phantomair.top2026-09-11UnknownNICENIC
phantom-lottery.vercel.app2026-09-11OnlineVercel
mysticdao.click2026-09-11OfflineGlobal Domain
aestherekmewear.shop2026-09-09OnlineDynadot
aestherekme.shop2026-09-09OnlineDynadot
phantomapp.io2026-09-09OnlineNAMECHEAP
tryphantom.xyz2026-09-09OfflineGoDaddy.com
phantompred.pages.dev2026-09-09OfflineCloudflare Pages
adoretail.shop2026-09-09OnlineDynadot
abovethecloudslabel.shop2026-09-09OnlineDynadot

All 1,008 Phantom reports

Where they are registered and hosted

Registrars

  1. Cloudflare182
  2. MarkMonitor58
  3. PublicDomainRegistry.com54
  4. Global Domain38
  5. GOOGLE (ASN: 15169)37
  6. CSC Corporate Domains31
  7. Tucows Domains29
  8. Gname.com29

Top-level domains

  1. .com206
  2. .dev162
  3. .app78
  4. .io36
  5. .xyz36
  6. .fun32
  7. .at26
  8. .top23

Hosting networks

  1. CLOUDFLARENET, US266
  2. Cloudflare, Inc.160
  3. CLOUDFLARENET - Cloudflare, Inc., US66
  4. AMAZON-02, US64
  5. GOOGLE, US60
  6. Google LLC54
  7. Amazon.com, Inc.44
  8. metaspinner-asn metaspinner net GmbH, DE18

Related

Data: PhishDestroy domain-report database, built 2026-10-22. Counts cover every reported domain whose stored target brand is Phantom; share of all PhishDestroy reports: 0.45%.