en-phntom-uss[.]pages[.]dev

en-phntom-uss.pages.dev is currently flagged as a brand‑impersonation site that masquerades as the Phantom cryptocurrency wallet. The domain was registered on 21 February 2026 through Cloudflare, Inc. and resolves to the Cloudflare‑owned address 172.66.44.98, which is assigned to AS13335 in the United States. The site presents a TLS certificate issued by Google Trust Services under the WE1 authority, indicating a legitimate‑looking HTTPS endpoint, and the web server advertises HSTS, HTTP/3 and Cloudflare as the front‑end. The page title returned by the server reads “Phantom Wallet | Secure Multichain Wallet for Solana and Web3 — Presentation”, aligning with the known scam type of wallet/seed phishing. Infrastructure analysis shows the domain is hosted on Cloudflare’s edge network, using the nameservers lorna.ns.cloudflare.com and lochlan.ns.cloudflare.com.

The Gridinsoft trust score is 0 / 100, and ten of ninety‑five security vendors on VirusTotal have flagged the domain as malicious. It is listed on a single external blocklist and has been proactively taken down by the PhishDestroy remediation service. An HTTP 403 response is observed, suggesting the site is no longer serving content. Defenders should treat any URLs or assets that resolve to this domain as hostile, especially those that request private seed phrases or private keys.

Blocking the domain at the DNS or proxy level, and adding it to internal threat‑intel feeds, will prevent accidental user exposure. Monitoring for similarly‑named variants that use the “en‑phntom‑uss” pattern is advisable, as the naming scheme appears crafted to mimic the legitimate Phantom brand. At present, no further content analysis is available beyond the page title, and the site’s offline status limits immediate observation of payloads. Continuous verification of Cloudflare‑registered domains that target cryptocurrency wallets is recommended to reduce exposure to emerging impersonation campaigns.