phantom-en-us[.]created[.]app

Analysis of phantom-en-us.created.app shows a domain registered through Tucows Domains Inc. on July 12 2023. The site resolves to the Amazon‑owned IP address 216.150.1.193 located in the United States and is hosted on the Vercel platform, as indicated by the presence of ns1.vercel-dns.com and ns2.vercel-dns.com as authoritative name servers. The TLS certificate is provided by Let’s Encrypt (R13), and HTTP requests return a 404 status, suggesting the content is no longer served. The page title retrieved from the site, “Phantom Wallet™ – The Secure Multi-Chain Crypto Wallet,” directly references the Phantom brand, confirming a brand-impersonation intent.

VirusTotal scans have flagged the domain on 11 of 95 security vendor engines, and the domain is listed on a single security blocklist. PhishDestroy has already taken the domain offline, and current monitoring shows the site is no longer reachable. Technical fingerprints include enforced HTTP Strict Transport Security (HSTS) and Vercel‑specific web technologies.

While the offline status limits immediate threat exposure, the combination of brand‑impersonation, a crypto‑wallet page title, and detection by multiple vendors indicates a high likelihood that the domain was used for a crypto‑related scam. Defenders should continue to block the domain at perimeter devices, update URL filtering rules, and monitor for any re‑registration attempts. Incident response teams should also correlate any internal logs that reference connections to 216.150.1.193 during the active period, and consider adding the domain to internal threat intelligence feeds.