phantomwalletextensiondownload[.]blogspot[.]co[.]za

This report documents a technical threat identified as a cryptocurrency scam. The site, accessed via the domain phantomwalletextensiondownload.blogspot.co.za, presented a page title of "Phantom wallet extension download" and impersonated the legitimate Phantom brand. The threat posed involves tricking users into downloading a malicious version of the Phantom wallet extension, potentially leading to theft of cryptocurrency credentials and funds.

Technical evidence confirms the malicious nature of the site. VirusTotal flagged it with 11 out of 95 security vendors detecting it as malicious. The domain was flagged by multiple security vendors, including alphaMountain.ai, BitDefender, CRDF, CyRadar, and ESET. It appears on 1 blocklist. The site was hosted on IP address 142.250.186.97, located in Germany, and associated with AS15169 Google LLC. The domain registrar was GOOGLE (ASN 15169). The SSL certificate was issued by Google Trust Services for the WE2 domain.

As of the time of analysis, the site is down or offline. The risk level is considered high due to the confirmed impersonation of a well-known cryptocurrency brand and the significant detection rate by security vendors. Users should avoid any interaction with this domain.