phantuwallett[.]webflow[.]io

Analysis of the domain phantuwallett.webflow.io indicates it was actively impersonating the Phantom cryptocurrency wallet, a campaign classified as a crypto scam. The domain, hosted on Cloudflare infrastructure, resolved to the IP address 104.18.36.248, associated with AS13335 (Cloudflare, Inc.) in the United States. The nameservers journey.ns.cloudflare.com and lamar.ns.cloudflare.com further confirm Cloudflare's role in its hosting. The domain was registered through MarkMonitor, Inc. on May 8, 2013, though this registration date predates the observed malicious activity, suggesting potential subdomain misuse or compromise of an older, legitimate Webflow.io subdomain. At the time of assessment, the domain returned an HTTP 404 status, indicating it was taken offline.

However, prior to its removal, the page title displayed 'P̟h̟a̟n̟t̟o̟m̟® W̟a̟l̟l̟e̟t̟ - A̟ f̟r̟i̟e̟n̟d̟l̟y̟ S̟o̟l̟a̟n̟a̟ w̟a̟l̟l̟e̟t̟ b̟u̟i̟l̟t̟ f̟o̟r̟ D̟e̟F̟i̟,' which directly references the Phantom brand and Solana blockchain, aligning with the reported scam type. The use of Unicode characters in the page title appears to be an attempt to evade basic text-based detection mechanisms. The domain was flagged by one security blocklist and detected by 14 of 93 security vendors on VirusTotal, confirming its malicious classification. The SSL certificate was issued by Google Trust Services (WE1), a common certificate authority for both legitimate and malicious domains. Infrastructure analysis reveals the domain leveraged Cloudflare's CDN and HTTP/3 protocol, which can obscure the origin server and complicate takedown efforts.

The single blocklist detection and moderate VirusTotal vendor flagging suggest the campaign was relatively contained or detected in its early stages. Defenders should treat any prior interaction with this domain as a potential security incident, particularly if cryptocurrency transactions or wallet credentials were involved.