phantom-wallets[.]blogspot[.]li

This domain presents a high-risk brand impersonation threat specifically targeting users of the Phantom cryptocurrency wallet. Analysis indicates the domain was designed to mimic the legitimate Phantom wallet interface, potentially tricking users into entering sensitive credentials or private keys. The page title, 'Phantom Wallet - A friendly Crypto Wallet,' directly replicates the branding language of the authentic service, increasing the likelihood of successful deception among cryptocurrency users seeking wallet solutions. Infrastructure analysis reveals multiple technical indicators supporting the malicious classification of this domain. The domain was registered on February 21, 2026, through Google LLC and currently resolves to the IP address 142.251.208.1, associated with AS15169 (Google LLC). Security vendors have flagged this domain extensively, with VirusTotal reporting 16 out of 95 detections as malicious. Additionally, the domain appears on three independent security blocklists and is explicitly blocked by cryptocurrency security systems. The SSL certificate, issued by Google Trust Services (WE2), does not mitigate the risk, as fraudulent domains frequently leverage valid certificates to appear legitimate. Users who visited phantom-wallets.blogspot.li should take immediate action to secure their assets and credentials. Any interaction with the site, particularly inputting wallet recovery phrases, private keys, or passwords, necessitates revoking access to all connected applications and transferring funds to a new, secure wallet. Affected users should also monitor their accounts for unauthorized transactions and enable multi-factor authentication where available. Given the domain's offline status, users should remain vigilant for similar impersonation attempts through other domains or communication channels. Cryptocurrency users are advised to verify domain authenticity through official sources before interacting with any wallet-related services.