Phishing- und Sicherheitsprüfung für phantom-wallet--en.pages.dev

The domain phantom-wallet--en.pages.dev was registered on February 21, 2026 through Cloudflare, Inc. and resolves to the IP address 188.114.96.3, which belongs to AS13335 Cloudflare, Inc. in the United States. The site presents a page title of "Suspected phishing site | Cloudflare" and serves an SSL certificate issued by Google Trust Services under the WE1 label, indicating a valid HTTPS endpoint. Network analysis shows the presence of HSTS, Cloudflare front‑end services, and HTTP/3 support, while the HTTP response returned a 403 status code at the time of observation. Reputation checks reveal that 15 out of 95 security vendors on VirusTotal flagged the domain, and Google Safe Browsing categorised it as social engineering.

The Gridinsoft trust score is recorded as 0 out of 100, and the domain appears on a single security blocklist. It has been blocked by the PhishDestroy service. The nameservers listed are sri.ns.cloudflare.com and bristol.ns.cloudflare.com. The evidence collectively points to a high‑risk crypto‑related brand impersonation campaign targeting users of the Phantom wallet service.

While the page content has not been captured, the combination of a brand‑targeted domain, low trust scores, multiple vendor detections, and explicit Safe Browsing warnings suggests malicious intent. Defenders should continue to block the domain at network perimeters, update URL filtering policies to include the observed IP and nameservers, and monitor for any re‑hosting attempts. Additional investigation of traffic patterns to the IP address and correlation with other Phantom‑related phishing indicators is recommended to assess the broader campaign scope.