help-phantom-en[.]created[.]app

help-phantom-en.created.app is registered through Tucows Domains Inc. and was created on July 12, 2023. The domain resolves to IP address 216.150.1.129, which belongs to Amazon.com, Inc. (AS16509) and is located in the United States. DNS resolution is handled by Vercel’s authoritative name servers ns1.vercel-dns.com and ns2.vercel-dns.com, and the site presents a Vercel‑hosted front end that enforces HTTP Strict Transport Security. The TLS certificate is provided by Let’s Encrypt under the R13 issuance, confirming the use of a publicly available certificate.

The page title returned by the server is “Homepage,” and the HTTP response code is 404, indicating that the expected content is not currently served. Google Safe Browsing classifies the domain as a social engineering threat, and the site is listed on a single security blocklist that is monitored by PhishDestroy, which has taken the domain offline. VirusTotal reports that 10 of 95 scanned security vendors flag the domain, providing moderate detection confidence.

The campaign is identified as a crypto‑related scam that impersonates the Phantom brand. While the infrastructure details are clear, the exact malicious payload or user‑facing content has not been publicly captured. Defenders should block the domain at DNS and network layers, monitor for any future re‑registration attempts, and correlate any observed traffic to the associated IP and Vercel infrastructure with other known Phantom‑related abuse indicators.