# phantomwallet.framer.website — MALICIOUS

> phantomwallet.framer.website impersonates Phantom Wallet posing medium risk. Stay alert and avoid interaction with this offline phishing domain.

## Summary
PhishDestroy identifies phantomwallet.framer.website as a brand impersonation threat targeting the Phantom Wallet user base. The domain mimics the official Phantom Wallet branding with a page titled "Phantom Wallet | Phantom secure," aiming to deceive users into trusting the fraudulent site.

Technically, the domain was registered on November 19, 2021, via CSC Corporate Domains Inc., and resolves to IP address 35.71.142.77. It has been flagged by multiple security vendors on VirusTotal and appears on two security blocklists, indicating its involvement in malicious activities consistent with phishing campaigns.

Currently, phantomwallet.framer.website is offline, reflecting effective takedown or mitigation efforts. Users are advised to remain vigilant against similar impersonation attempts and verify URLs carefully before engaging with any cryptocurrency wallet services.

## Threat Details
- Verdict: MALICIOUS
- Site status: dead (HTTP 404)
- Target brand: Phantom
- Page title: Phantom Wallet | Phantom secure

## Domain Intelligence
- Registered: 2021-11-19 16:04:21
- Registrar: CSC Corporate Domains, Inc.
- Country: US
- IP: 35.71.142.77
- IP Country: US
- IP City: Seattle
- IP Org: AS16509 Amazon.com, Inc.
- Nameservers: ns-1243.awsdns-27.org ns-1818.awsdns-35.co.uk ns-336.awsdns-42.com ns-792.awsdns-35.net
- SSL Issuer: Let's Encrypt / E7

## Detection Status
- VirusTotal: 9 vendors flagged
  Vendors: ["ChainPatrol", "alphaMountain.ai", "CRDF", "CyRadar", "ESET", "Google Safebrowsing", "Kaspersky", "Lionic", "Webroot"]
- Google Safe Browsing: clean
- Blocklists: 2 hits
  Lists: ["PhishDestroy", "MetaMask"]

## Evidence
- Screenshot: https://urlscan.io/screenshots/019ad02f-6c3e-710b-827f-7e6dc16a6b77.png
- Cloudflare Radar: https://radar.cloudflare.com/scan/3009066e-6a2d-450a-8037-5366e9eda46b
- Wayback Machine: https://web.archive.org/web/https://phantomwallet.framer.website
- PhishDestroy: https://phishdestroy.io/domain/phantomwallet.framer.website/
- LLM endpoint: https://phishdestroy.io/domain/phantomwallet.framer.website/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/phantomwallet.framer.website/
Last updated: 2026-03-19