# PhishDestroy threat dossier — phantom-my.at ================================================================ Fetched: 2026-05-17 14:00:18 UTC Canonical: https://phishdestroy.io/domain/phantom-my.at/ ## VERDICT ---------------------------------------------------------------- CRITICAL THREAT — DO NOT VISIT Composite threat score: 81/100 (PhishDestroy scoring — see methodology below) Targeted brand: Phantom Wallet drainer: Solana Drainer ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 13/95 security vendors flagged this domain Flagging vendors: ADMINUSLabs, alphaMountain.ai, BitDefender, CRDF, CyRadar, ESET, Fortinet, G-Data, Kaspersky, LevelBlue, Lionic, Sophos, VIPRE URLQuery: 2 detections ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 45.59.122.25 Registrar: Hosting concepts B.V. / Registrar.eu ( https://nic.at/registrar/648 ) Nameservers: a.dnspod.com, b.dnspod.com, c.dnspod.com Registered: 2026-05-17 Page title: Site is being set up... HTTP response: 200 ## TLS CERTIFICATE ---------------------------------------------------------------- Issuer: Let's Encrypt / R12 Expires: 2026-08-03 Status: INVALID chain Fingerprint: 64c023d9469b720cfc130bfed7048752c0a6766d0b1dd7278a1e2b501ca8ba64 Subject Alternative Names (related infrastructure — often same operator): - www.phantom-my.at ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: pending notification queue. No abuse reports filed yet — this domain is waiting for the next cycle of our automated abuse-reporter. ## TIMELINE ---------------------------------------------------------------- Domain registered: 2026-05-17 (per WHOIS / CT — may reflect a renewal or transfer date, not first-ever registration) First detected: 2026-05-17 14:48:24 UTC (by PhishDestroy tracker) Earliest abuse rec: 2026-05-17 11:51:00 UTC — PREDATES current WHOIS registration; retained from a previous registration cycle of the same domain name Last verified: 2026-05-17 16:00:07 UTC Current status: ACTIVE / observable Note: one or more events above predate the WHOIS creation date. This typically means the same domain name was previously registered, detected, dropped, and then re-registered by a new party. PhishDestroy preserves the full historical record for operator-attribution research even when the underlying infrastructure changes hands. ## EXTERNAL CORROBORATION (third-party evidence) ---------------------------------------------------------------- URLScan.io: https://urlscan.io/result/019e35c3-4c4c-72b2-9fb7-def864166f83/ URLQuery: https://urlquery.net/report/ce912b34-c79f-438c-8081-530d2418873e Wayback Machine: https://web.archive.org/web/*/phantom-my.at crt.sh CT logs: https://crt.sh/?q=%25.phantom-my.at Google transparency: https://transparencyreport.google.com/safe-browsing/search?url=phantom-my.at AlienVault OTX: https://otx.alienvault.com/indicator/domain/phantom-my.at URLhaus: https://urlhaus.abuse.ch/host/phantom-my.at/ ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-05-17 14:49:24 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] PhishDestroy identifies phantom-my.at as an active Solana crypto drainer impersonating the Phantom wallet. This domain was flagged by 13 out of 95 VirusTotal security vendors, indicating widespread suspicion of malicious activity. Registered through Hosting Concepts B.V. via Registrar.eu, the domain resolves to IP 45.59.122.25 and utilizes a Let's Encrypt SSL certificate to appear legitimate. The drainer kit is specifically designed to target Solana wallet users, posing a high risk of cryptocurrency theft. The domain phantom-my.at leverages brand impersonation to deceive users into entering their wallet credentials or connecting their wallets to malicious smart contracts. Phantom wallet users are specifically targeted, as the scam domain mimics the official Phantom branding to lend credibility. The Solana drainer kit is equipped to siphon funds from connected wallets without requiring explicit transaction approvals, making it a particularly dangerous threat. Evidence of its malicious nature is corroborated by its presence on multiple blocklists and the high detection rate on VirusTotal. Users who have visited phantom-my.at should immediately disconnect their wallets from the site and revoke any connected permissions via their wallet's security settings. Transferring any remaining funds to a cold wallet or a newly created one is strongly advised. Scanning devices for malware using reputable antivirus software is also recommended, as crypto drainers often bundle additional payloads. Report the domain to PhishDestroy and your wallet provider to help prevent further victimization. ## EVIDENCE HASHES ---------------------------------------------------------------- PhishDestroy Case ID: PD-20260517-BF78F3 Favicon MD5: 6646c3c645f7345fe509d3a770718920 TLS cert SHA-256: 64c023d9469b720cfc130bfed7048752c0a6766d0b1dd7278a1e2b501ca8ba64 ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (volunteer takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/phantom-my.at/ JSON API: https://api.destroy.tools/v1/check?domain=phantom-my.at Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: volunteer-driven open-source threat-intelligence platform. Tracked: 150,621 domains (28,738 alive under monitoring, 121,602 confirmed takedowns/dead). Site: https://phishdestroy.io