phantamullatex[.]gitbook[.]io

Analysis of the domain phantamullatex.gitbook.io indicates an active high-risk brand impersonation campaign targeting Phantom, a Solana-based cryptocurrency wallet. The domain, registered through Cloudflare, Inc. on March 30, 2014, currently resolves to the IPv6 address 2606:4700:4402::ac40:93d1, hosted behind Cloudflare infrastructure. The page title, 'Phantom Wallet | A friendly Solana wallet built for DeFi & NFTs | Phantom Wallet,' directly mirrors official Phantom branding, suggesting an intent to deceive users into interacting with fraudulent wallet services. Infrastructure analysis reveals the use of Cloudflare technologies and HTTP/3, common in both legitimate and malicious deployments. The domain holds a Gridinsoft trust score of 0/100 and appears on at least one security blocklist, with PhishDestroy having already flagged it for blocking. As of July 12, 2026, twelve of ninety-five security vendors on VirusTotal have detected the domain as malicious, though the absence of additional context limits conclusions about the specific payload or attack vector. The domain remains active, and while the registration date predates the current campaign, this does not preclude malicious repurposing. Defenders should prioritize blocking resolutions to the identified IPv6 address and monitor for further indicators of compromise. Given the impersonation of a cryptocurrency wallet, the risk of credential theft or unauthorized transaction execution is elevated. No evidence currently links this domain to a broader phishing kit or campaign infrastructure, and the exact content of the site has not been analyzed for additional malicious functionality.