phantom-wallett[.]blogspot[.]com

This domain, phantom-wallett.blogspot.com, is currently listed as offline and returns HTTP 404. The site’s page title, “Phantom Wallet – A friendly Crypto Wallet,” explicitly references the Phantom brand, indicating a wallet‑seed phishing campaign. The domain was created on 31 July 2000 and is hosted on Google’s infrastructure (IP 216.58.206.65, ASN 15169, located in Germany). DNS resolution shows the standard Google nameservers ns1‑ns4.google.com.

The TLS certificate is issued by Google Trust Services under the WE2 intermediate, confirming the use of legitimate Google SSL infrastructure. Technology fingerprinting detected Blogger, Java, Python, OpenGSE, Google Analytics, and HTTP/3, all common to legitimate blogs but also useful for attackers to embed malicious scripts. Security‑vendor analysis on VirusTotal reports that 16 of 93 scanners flag the domain as malicious, and Google Safe Browsing classifies it under “social engineering.” The Gridinsoft trust score is 0 / 100, and the domain appears on a single external blocklist. PhishDestroy has already blocked the domain, and the registrar is MarkMonitor, Inc., a provider often used by high‑profile brands, suggesting the registration may have been spoofed or compromised.

Evidence confirms impersonation of the Phantom cryptocurrency wallet, but because the site is offline, the exact phishing page content and any credential‑stealing mechanisms cannot be observed. Defenders should treat the indicator as high‑severity, add the domain to internal deny‑lists, monitor for any resurrection or fast‑flux activity, and educate users that any unsolicited request for a Phantom seed phrase from a blog‑style URL is likely fraudulent. Continuous re‑evaluation is advised in case the domain becomes active again.