phantom-wallet[.]blogspot[.]sk

The domain phantom-wallet.blogspot.sk is actively hosting a crypto‑related brand impersonation campaign targeting users of the Phantom wallet. Infrastructure analysis shows the domain resolves to the Google‑owned IP address 142.250.185.97 (AS15169, United States) and is served from Google’s own nameserver set (ns1‑ns4.google.com). The site presents the page title "Phantom Wallet - A friendly Crypto Wallet," directly mirroring the legitimate brand, and is built on the Blogger platform with supporting technologies including Java, Python, OpenGSE, and HTTP/3. An SSL certificate issued by Google Trust Services (WE2) secures the connection, reinforcing the appearance of legitimacy.

HTTP responses return a 302 status code, indicating a temporary redirect that may conceal the final malicious landing page. The registrar listed is MarkMonitor, Inc., a provider often used by corporate brands for domain protection, suggesting the attackers deliberately leveraged a reputable registrar to increase credibility. VirusTotal analysis flagged the domain by 12 of 93 security vendors, and the site is listed on a security blocklist and has been blocked by PhishDestroy, evidencing consensus among threat intelligence sources that the domain is malicious. The domain was created on 30 November 2006 and remains active as of the report date, demonstrating a long‑standing infrastructure that has been repurposed for current abuse.

While the exact content of the redirected page has not been publicly disclosed, the combination of brand‑matching page title, Google‑hosted infrastructure, SSL from a trusted CA, and multiple vendor detections provides strong evidence of a crypto scam leveraging brand impersonation. Defenders should block the domain at perimeter and DNS layers, monitor for outbound connections to the associated IP, and consider sinkholing the hostname to disrupt the campaign.