phantomwalletdownload[.]blogspot[.]com[.]mt

This domain, phantomwalletdownload.blogspot.com.mt, is actively impersonating Phantom, a cryptocurrency wallet service, as indicated by its page title 'Phantom Wallet Download' and confirmed brand target data. Registered under AS15169 (Google LLC), the domain resolves to IP 142.251.40.225, located in the United States, and is hosted on Blogger infrastructure. Analysis reveals the use of technologies including Java, Python, OpenGSE, and HTTP/3, which are consistent with legitimate web services but are being exploited here for malicious purposes. The domain currently returns an HTTP 302 redirect status, suggesting it may be dynamically routing visitors to other malicious endpoints or serving deceptive content. It appears on one security blocklist and is flagged by 8 out of 95 security vendors on VirusTotal, indicating a high likelihood of malicious activity. The scam type is classified as cryptocurrency-related, aligning with the impersonation of a well-known wallet provider to likely harvest credentials or distribute malware. Infrastructure analysis shows the domain uses an SSL certificate issued by Google Trust Services, which does not inherently validate the legitimacy of the site but ensures encrypted connections. The exact content served by the domain remains unconfirmed, as no direct analysis of the page has been conducted beyond its title and classification. Defenders should treat this domain as high-risk and prioritize blocking or monitoring traffic to it, particularly in environments where cryptocurrency-related services are accessed. Given the domain's active status and association with a trusted hosting provider, organizations should investigate any historical or ongoing connections to 142.251.40.225 or the domain itself. The use of Blogger as a platform for this scam underscores the need for heightened scrutiny of subdomains and third-party hosted content, even when the parent domain is reputable.