phantomweb-wallet-supportteam[.]webflow[.]io

The domain phantomweb-wallet-supportteam.webflow.io is registered through MarkMonitor, Inc. and is hosted on Cloudflare infrastructure, resolving to IP address 104.18.36.248, which belongs to AS13335 Cloudflare, Inc. in the United States. The authoritative nameservers are journey.ns.cloudflare.com and lamar.ns.cloudflare.com, confirming the use of Cloudflare’s DNS services. TLS termination is provided by a certificate issued by Google Trust Services under the WE1 authority, indicating a valid HTTPS endpoint despite the site’s malicious intent. An HTTP request to the domain returns a 404 status code with the page title "404 - Page not found," suggesting the content has been removed or the site is deliberately offline at the time of analysis.

The site advertises a brand impersonation of Phantom and is classified as a crypto‑related scam, consistent with the observed branding and the "Crypto Scam" label. VirusTotal scans have recorded 14 detections out of 95 security vendors, and the domain is listed on a single security blocklist, with PhishDestroy confirming the block. Detected technologies include Cloudflare’s content delivery services and HTTP/3 support, which are typical for fast‑response malicious infrastructure.

While the HTTP response provides limited insight into the actual phishing payload, the convergence of registrar, hosting, SSL, detection, and blocklist data presents a strong confidence level that the domain was used for fraudulent activity targeting Phantom users. Defenders should block the domain and its associated IP address at network perimeters, add the domain to URL filtering policies, and monitor for any related sub‑domains or similar Cloudflare‑hosted assets that might be employed in future campaigns. Continuous re‑scanning of the domain is advised in case the site is re‑activated, and any observed traffic should be correlated with threat‑intel feeds for potential attribution.