phantom-wallet[.]blogspot[.]pe

This domain, phantom-wallet.blogspot.pe, poses as a legitimate Phantom cryptocurrency wallet interface to deceive users into entering sensitive credentials or transferring digital assets. Analysis indicates the site is designed to execute unauthorized transactions, likely functioning as a crypto drainer that siphons funds from connected wallets without consent. The page title, 'Phantom Wallet - A friendly Crypto Wallet,' directly mirrors the branding of the authentic Phantom service, increasing the likelihood of successful deception among users seeking wallet access or support. Infrastructure analysis reveals the domain was registered through MarkMonitor, Inc., and resolves to IP address 142.250.185.97, hosted on Google LLC infrastructure (AS15169). The SSL certificate is issued by Google Trust Services, providing a false sense of security. At the time of detection, the domain appeared on 3 security blocklists and was flagged by 10 out of 95 security vendors on VirusTotal. The combination of brand impersonation, hosting on a reputable provider, and minimal initial detection underscores the targeted nature of this threat. Users who visited phantom-wallet.blogspot.pe or interacted with its content should immediately revoke any wallet permissions granted to unknown or suspicious sites. Disconnect the wallet from all decentralized applications and transfer remaining assets to a new, secure wallet address. Monitor transaction history for unauthorized activity and report the incident to relevant security teams or community platforms. If credentials were entered, assume they are compromised and avoid reusing them across any services. Enable multi-factor authentication where available and remain vigilant for follow-up phishing attempts via email or social media.