# PhishDestroy domain threat record: phantom-defi-tips.com Content language: English Canonical HTML report: https://phishdestroy.io/domain/phantom-defi-tips.com/ Machine-readable companion: https://phishdestroy.io/domain/phantom-defi-tips.com/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-10-23 02:07:29 UTC - Last availability or vendor check: 2026-10-23 02:07:29 UTC - Stored record updated: 2026-10-23 06:22:42 UTC - VirusTotal detections in the stored snapshot: 1/92 - Independent public blocklist matches in the stored snapshot: 2 - Matching public blocklists: MetaMask, SEAL - Google Safe Browsing stored result: no stored flag ## Stored classification - Targeted brand: phantom ## Stored infrastructure - Observed IP address: 172.67.166.104 - Registrar in stored WHOIS data: Spaceship, Inc. - Last stored HTTP status: 200 - Registration date (registry RDAP, phantom-defi-tips.com): 2026-04-09 11:52:39 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a16681-f337-73e7-bab3-e965a563e362/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/phantom-defi-tips.com - Certificate Transparency search: https://crt.sh/?q=%25.phantom-defi-tips.com - Web Archive lookup: https://web.archive.org/web/*/https://phantom-defi-tips.com/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview PhishDestroy’s automated assessment classified phantom-defi-tips.com as a “Seed Phrase Theft” page because it references the Phantom Wallet brand and claims to offer independent DeFi reviews. The intake on 2026-10-23 noted the page title “Phantom Wallet DeFi Features, Reviews & User Guides” and recorded a brand‑impersonation signal. An HTTP 200 response was observed on the same day, confirming the site was reachable at the time of detection. How the scam works Seed‑phrase theft sites typically pose as guides, tutorials or service portals and ask visitors to paste their wallet recovery phrase, often under the pretense of verification or unlocking features. Once the phrase is submitted, the attacker gains full control of the wallet and can move any assets. Evidence VirusTotal scanned the domain on 2026-10-22 and reported one malicious detection out of 92 engines, flagged by Netcraft. Google Safe Browsing checked on 2026-10-23 and did not flag the site. External blocklists MetaMask and SEAL listed the domain on 2026-10-23, and PhishDestroy’s internal blocklist also contains it. Cloudflare Radar’s scan on 2026-10-23 labeled the page as phishing, OTX recorded four pulses referencing the domain, and two URLScan captures (2026-10-22 and 2026-10-23) returned overall clean verdicts while their engine analysis marked the page malicious with a high confidence score. Infrastructure The domain was registered on 2026-04-09 through Spaceship, Inc., with a client‑transfer‑prohibited status. Hosting is provided by Cloudflare, observed via the IP addresses 172.67.166.104 and 104.21.11.159 (AS 13335) and a TLS certificate issued by Google Trust Services, valid until 2027-01-02. The recorded network location is Canada. What to do Anyone who may have entered a recovery phrase should treat the associated wallet as compromised, create a new wallet and move funds immediately, and revoke any token approvals. If login credentials were submitted, change the passwords on the affected services. Defenders should block phantom-defi-tips.com at the perimeter, monitor access logs for requests to this exact domain, and apply any incident‑response procedures for potential seed‑phrase exposure. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a16681-f337-73e7-bab3-e965a563e362/ Cloudflare Radar report: https://radar.cloudflare.com/scan/778ffead-63b1-43af-aee5-4de97570c3dc URLQuery report: https://urlquery.net/report/999c6203-92f1-4996-bb14-fdcf1da0adad Stored capture screenshot: https://i.ibb.co/mCgSpSbq/b384a1c379af.png Cloudflare Radar screenshot (2026-10-23T02:41:06Z): https://screenshots.phishdestroy.io/cf/778ffead-63b1-43af-aee5-4de97570c3dc.png URLScan screenshot (2026-10-06T14:29:06Z): https://screenshots.phishdestroy.io/us/01a1119e-21a5-762f-9161-82723c256bc2.png URLScan capture report: https://urlscan.io/result/01a1119e-21a5-762f-9161-82723c256bc2/ URLScan screenshot (2026-10-10T10:28:37Z): https://screenshots.phishdestroy.io/us/01a1255b-6d7e-7209-8478-e856f5a7e36e.png URLScan capture report: https://urlscan.io/result/01a1255b-6d7e-7209-8478-e856f5a7e36e/ URLScan screenshot (2026-10-10T14:54:04Z): https://screenshots.phishdestroy.io/us/01a1264e-728f-71e0-8ee9-dd252e4ef3a2.png URLScan capture report: https://urlscan.io/result/01a1264e-728f-71e0-8ee9-dd252e4ef3a2/ URLScan screenshot (2026-10-18T08:31:15Z): https://screenshots.phishdestroy.io/us/01a14e22-d893-753a-83be-906a8c7c33b4.png URLScan capture report: https://urlscan.io/result/01a14e22-d893-753a-83be-906a8c7c33b4/ URLScan screenshot (2026-10-18T13:24:28Z): https://screenshots.phishdestroy.io/us/01a14f2f-4786-70e9-a001-5a9ebb9d495d.png URLScan capture report: https://urlscan.io/result/01a14f2f-4786-70e9-a001-5a9ebb9d495d/ URLScan screenshot (2026-10-23T02:10:24Z): https://screenshots.phishdestroy.io/us/01a16685-f8c4-7298-b50b-18055fdff638.png URLScan capture report: https://urlscan.io/result/01a16685-f8c4-7298-b50b-18055fdff638/ VirusTotal report: https://www.virustotal.com/gui/domain/phantom-defi-tips.com Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=phantom-defi-tips.com Revoke token approvals: https://revoke.cash/ Report crypto fraud (Chainabuse): https://www.chainabuse.com/report Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-23 02:48:53 UTC ## Stored page captures - Primary capture: https://i.ibb.co/mCgSpSbq/b384a1c379af.png Captured: 2026-10-23 02:07:29 UTC - URLScan capture 1: https://screenshots.phishdestroy.io/01a16681-f337-73e7-bab3-e965a563e362.png Captured: 2026-10-23 02:07:29 UTC Source report: https://urlscan.io/result/01a16681-f337-73e7-bab3-e965a563e362/ - URLScan capture 2: https://urlscan.io/screenshots/01a16336-2a28-71de-bcbc-64c7940165f2.png Captured: 2026-10-23 01:37:26 UTC Source report: https://urlscan.io/result/01a16681-f337-73e7-bab3-e965a563e362/ - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/778ffead-63b1-43af-aee5-4de97570c3dc.png Captured: 2026-10-23 02:41:06 UTC Source report: https://radar.cloudflare.com/scan/778ffead-63b1-43af-aee5-4de97570c3dc SHA-256: 7ecc6917f05fb65b28804c58cd37c552bc9151d98bca125f466c077ec446dfef - URLQuery: https://screenshots.phishdestroy.io/uq/999c6203-92f1-4996-bb14-fdcf1da0adad.png Source report: https://urlquery.net/report/999c6203-92f1-4996-bb14-fdcf1da0adad SHA-256: 9d3efd0444a87b7b665a28b44c3a24ebe9f6caa0d4e3eed73367e3ae9c725614 - URLScan · 2026-10-06: https://screenshots.phishdestroy.io/us/01a1119e-21a5-762f-9161-82723c256bc2.png Captured: 2026-10-06 14:29:06 UTC Source report: https://urlscan.io/result/01a1119e-21a5-762f-9161-82723c256bc2/ SHA-256: 1232e8104ab2320ce0076a7fafdf4f9acc3229766c2befe19fc86bcd8419f5c7 - URLScan · 2026-10-10: https://screenshots.phishdestroy.io/us/01a1255b-6d7e-7209-8478-e856f5a7e36e.png Captured: 2026-10-10 10:28:37 UTC Source report: https://urlscan.io/result/01a1255b-6d7e-7209-8478-e856f5a7e36e/ SHA-256: 1232e8104ab2320ce0076a7fafdf4f9acc3229766c2befe19fc86bcd8419f5c7 - URLScan · 2026-10-10: https://screenshots.phishdestroy.io/us/01a1264e-728f-71e0-8ee9-dd252e4ef3a2.png Captured: 2026-10-10 14:54:04 UTC Source report: https://urlscan.io/result/01a1264e-728f-71e0-8ee9-dd252e4ef3a2/ SHA-256: 1232e8104ab2320ce0076a7fafdf4f9acc3229766c2befe19fc86bcd8419f5c7 - URLScan · 2026-10-18: https://screenshots.phishdestroy.io/us/01a14e22-d893-753a-83be-906a8c7c33b4.png Captured: 2026-10-18 08:31:15 UTC Source report: https://urlscan.io/result/01a14e22-d893-753a-83be-906a8c7c33b4/ SHA-256: 1232e8104ab2320ce0076a7fafdf4f9acc3229766c2befe19fc86bcd8419f5c7 - URLScan · 2026-10-18: https://screenshots.phishdestroy.io/us/01a14f2f-4786-70e9-a001-5a9ebb9d495d.png Captured: 2026-10-18 13:24:28 UTC Source report: https://urlscan.io/result/01a14f2f-4786-70e9-a001-5a9ebb9d495d/ SHA-256: 1232e8104ab2320ce0076a7fafdf4f9acc3229766c2befe19fc86bcd8419f5c7 - URLScan · 2026-10-23: https://screenshots.phishdestroy.io/us/01a16685-f8c4-7298-b50b-18055fdff638.png Captured: 2026-10-23 02:10:24 UTC Source report: https://urlscan.io/result/01a16685-f8c4-7298-b50b-18055fdff638/ SHA-256: 1232e8104ab2320ce0076a7fafdf4f9acc3229766c2befe19fc86bcd8419f5c7 ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-23T02:46:58Z", "uuid": "01a16681-f337-73e7-bab3-e965a563e362", "scanned_at": "2026-10-23T02:06:00Z", "final_url": "https://phantom-defi-tips.com/", "status": 200, "redirected": "https-only", "redirects": [ { "to": "https://phantom-defi-tips.com/", "from": "http://phantom-defi-tips.com/", "status": 307 } ], "ip": "172.67.166.104", "ips": [ "172.67.166.104" ], "asns": [ "13335" ], "doc_hash": "d537efb168b3871e96c4a9fa7feb6e07714d69d9b06ba9b14f9f08c3335cbe23", "tls": { "san": [ "phantom-defi-tips.com" ], "cipher": "AES_128_GCM", "issuer": "WE1", "subject": "phantom-defi-tips.com", "protocol": "QUIC", "valid_to": "2027-01-02T08:04:35Z", "valid_from": "2026-10-04T07:04:40Z" }, "domain_age_days": 196, "apex_age_days": 196, "tls_age_days": 18, "tls_valid_days": 90, "requests": 5, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 99, "malicious": true }, "overall": { "score": 0, "malicious": false } }, "headers": { "server": "cloudflare", "content-type": "text/html; charset=utf-8", "x-frame-options": "DENY", "x-content-type-options": "nosniff", "referrer-policy": "strict-origin-when-cross-origin", "permissions-policy": "interest-cohort=()" } }, "cf": { "v": 1, "fetched_at": "2026-10-23T02:47:01Z", "uuid": "778ffead-63b1-43af-aee5-4de97570c3dc", "scanned_at": "2026-10-23T02:41:06Z", "final_url": "https://phantom-defi-tips.com/", "status": 200, "history": [ { "url": "https://phantom-defi-tips.com/", "status": 200 } ], "dom_hash": "9c829cc7e23821704ca2f5204da0558761f92f14d10b1759147440392fa09f06", "doc_hash": "8c16c0d3ecdef675905f9370699778ca41b5ac78caa48e84ba6a0a6d85c4b857", "phishing_v2": [ "phishing" ], "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "phantom-defi-tips.com", "type": "A", "value": "104.21.11.159" }, { "name": "phantom-defi-tips.com", "type": "A", "value": "172.67.166.104" }, { "name": "phantom-defi-tips.com", "type": "AAAA", "value": "2606:4700:3033::6815:b9f" }, { "name": "phantom-defi-tips.com", "type": "AAAA", "value": "2606:4700:3033::ac43:a668" } ], "dnssec_valid": false, "ip": "104.21.11.159", "whois": { "registrar": "Spaceship, Inc.", "created": "2026-04-09T11:52:39Z", "updated": "2026-04-09T12:57:31Z", "expires": "2027-04-09T11:52:39Z", "nameservers": [ "jean.ns.cloudflare.com", "terin.ns.cloudflare.com" ] } }, "vt": { "v": 1, "fetched_at": "2026-10-23T02:40:06Z", "analysis_at": "2026-10-22T13:13:32Z", "stats": { "timeout": 0, "harmless": 55, "malicious": 1, "suspicious": 0, "undetected": 36 }, "detections": { "Netcraft": "malicious" }, "reputation": 0, "created": "2026-04-09T00:00:00Z", "updated": "2026-04-09T00:00:00Z", "first_seen": "2026-04-09T13:13:03Z", "dns": [ { "ttl": 300, "type": "AAAA", "value": "2606:4700:3033::6815:b9f" }, { "ttl": 21600, "type": "NS", "value": "terin.ns.cloudflare.com" }, { "ttl": 300, "type": "A", "value": "172.67.166.104" }, { "ttl": 1800, "type": "SOA", "rname": "dns.cloudflare.com", "value": "jean.ns.cloudflare.com" }, { "ttl": 300, "type": "AAAA", "value": "2606:4700:3033::ac43:a668" }, { "ttl": 21600, "type": "NS", "value": "jean.ns.cloudflare.com" }, { "ttl": 300, "type": "A", "value": "104.21.11.159" } ], "dns_at": "2026-10-22T13:13:55Z", "jarm": "27d40d40d00040d00042d43d00041df04c41293ba84f6efe3a613b22f983e6", "cert": { "san": [ "phantom-defi-tips.com" ], "issuer": "Google Trust Services / WE1", "serial": "3164fad39fbee23e136d664ce7fabe62", "sha256": "de7aba7471c32e714b2305a7140f24d9cb817cc1cd2d7ce0bd35571b1c7a2779", "subject": "phantom-defi-tips.com", "valid_to": "2027-01-02T08:04:35Z", "valid_from": "2026-10-04T07:04:40Z" }, "rdap": { "status": [ "client transfer prohibited" ], "events": { "last changed": "2026-08-20T20:13:34Z", "registration": "2026-04-09T11:52:39Z", "registrar expiration": "2027-04-09T11:52:39Z", "last update of RDAP database": "2026-10-22T13:13:54Z" }, "registrar": "Spaceship, Inc.", "registrar_iana_id": "3862" } }, "webcheck": { "v": 1, "fetched_at": "2026-10-23T02:47:15Z", "mail_config": { "spf_lookups": 0 }, "caa_records": { "domain": "phantom-defi-tips.com" }, "block_lists": { "resolvers": 12, "blocked_count": 0 }, "archives": { "last": "2026-10-23T01:43:11Z", "first": "2026-10-23T01:43:11Z", "changes": 0, "days_archived": 1, "avg_page_bytes": 17850 }, "robots_txt": { "agents": [ "*" ], "present": true, "sitemaps": [ "https://phantom-defi-tips.com/sitemap-index.xml" ] }, "sitemap": { "present": true, "url_count": 55 }, "social_tags": { "ogUrl": "https://phantom-defi-tips.com/", "title": "Phantom Wallet DeFi Features, Reviews & User Guides", "ogType": "website", "ogTitle": "Phantom Wallet DeFi Features, Reviews & User Guides", "description": "Explore detailed guides and independent reviews on Phantom Wallet DeFi features. Understand staking, swaps, token management, security, and multi-chain use for seamless crypto activity.", "twitterCard": "summary_large_image", "canonicalUrl": "https://phantom-defi-tips.com/", "ogDescription": "Explore detailed guides and independent reviews on Phantom Wallet DeFi features. Understand staking, swaps, token management, security, and multi-chain use for seamless crypto activity." }, "trackers": { "requests": 4 }, "mixed_content": { "third_party_scripts": 0 }, "status": { "up": true, "code": 200, "timings": { "dns": 24, "tls": 19, "wait": 63, "connect": 36, "download": 11 }, "response_ms": 153 }, "tls_connection": { "alpn": "h2", "cipher": "TLS_AES_256_GCM_SHA384", "protocol": "TLSv1.3", "versions": [ "TLSv1.2", "TLSv1.3" ], "authorized": true, "forward_secrecy": true }, "ports": { "open": [ 80, 443, 8080 ] }, "carbon": { "bytes": 108576, "co2_grams": 0.004, "cleaner_than": 20 }, "dns_server": { "ns": [ { "ip": "172.64.32.121", "host": "jean.ns.cloudflare.com" }, { "ip": "108.162.193.236", "host": "terin.ns.cloudflare.com" } ], "zone": "phantom-defi-tips.com" }, "location": { "ip": "2606:4700:3033::6815:b9f", "asn": "13335", "org": "Cloudflare, Inc.", "city": "Toronto", "country": "CA" }, "ssl": { "issuer": "Google Trust Services / WE1", "subject": "phantom-defi-tips.com" }, "dns": { "A": [ "172.67.166.104", "104.21.11.159" ], "NS": [ "jean.ns.cloudflare.com", "terin.ns.cloudflare.com" ], "SOA": "{\"nsname\": \"jean.ns.cloudflare.com\", \"hostmaster\": \"dns.cloudflare.com\", \"serial\": 2416559585, \"refresh\": 10000, \"retry\": 2400, \"expire\": 604800, \"minttl\": 1800}", "AAAA": [ "2606:4700:3033::6815:b9f", "2606:4700:3033::ac43:a668" ] }, "dnssec": { "ds": false, "rrsig": false, "dnskey": false }, "hsts": { "message": "Site does not serve any HSTS headers." }, "http_security": { "xFrameOptions": "DENY", "referrerPolicy": "strict-origin-when-cross-origin", "xXSSProtection": false, "permissionsPolicy": "interest-cohort=()", "xContentTypeOptions": "nosniff", "contentSecurityPolicy": false, "strictTransportPolicy": false, "crossOriginOpenerPolicy": false, "crossOriginEmbedderPolicy": false, "crossOriginResourcePolicy": false }, "firewall": { "waf": "Cloudflare", "has_waf": true }, "get_ip": { "ip": "2606:4700:3033::ac43:a668", "family": 6 }, "redirects": { "chain": [ "https://phantom-defi-tips.com" ] }, "tech_stack": { "technologies": [ "AMP", "Astro", "Priority Hints", "Cloudflare", "Open Graph", "HTTP/3" ] }, "linked_pages": { "internal_count": 55 }, "whois": { "registrar": "Spaceship, Inc.", "created": "2026-04-09T11:52:39Z", "updated": "2026-04-09T12:57:31Z", "expires": "2027-04-09T11:52:39Z", "status": [ "clientTransferProhibited https://icann.org/epp" ], "nameservers": [ "jean.ns.cloudflare.com", "terin.ns.cloudflare.com" ] }, "headers": { "headers": { "server": "cloudflare", "content-type": "text/html; charset=utf-8", "x-frame-options": "DENY", "x-content-type-options": "nosniff", "referrer-policy": "strict-origin-when-cross-origin", "permissions-policy": "interest-cohort=()" } } } } ```