phantomwalletdownload[.]blogspot[.]com[.]cy

This domain is flagged as an active brand‑impersonation campaign targeting Phantom users. The page title "Phantom Wallet Download" directly references the Phantom brand, indicating intent to mislead users seeking the official wallet. Infrastructure analysis shows the domain resolves to 142.251.40.161, an address owned by Google LLC (ASN 15169) located in the United States. The SSL certificate is issued by Google Trust Services under the WE2 identifier, confirming the use of Google’s hosting infrastructure. The server returns an HTTP 302 redirect and advertises HTTP/3 support. Detected technologies include Blogger, Java, Python, and the OpenGSE library, suggesting a generic web‑app stack rather than a custom phishing kit. VirusTotal records seven of ninety‑five scanners flagging the domain, and it appears on one external blocklist. PhishDestroy has already blocked the site, yet the domain remains reachable. The listed scam type is cryptocurrency, implying the page likely attempts to lure victims into installing a malicious wallet or disclosing private keys, although the exact content of the landing page has not been examined and the specific credential‑capture mechanism remains unknown. Defenders should block or sinkhole the domain, monitor DNS queries for the resolved IP, and enforce network controls that prevent connections to this host. Email filters should flag any messages containing the phrase "Phantom Wallet Download" or links to this domain. Continuous monitoring of the IP address and associated ASN is recommended, as the infrastructure may be reused for further impersonation campaigns.