phantomcash[.]digital

This domain, phantomcash.digital, is flagged for brand impersonation targeting Phantom, a widely used cryptocurrency wallet. The site is designed to deceive users into entering sensitive credentials, such as private keys or recovery phrases, under the guise of a legitimate Phantom interface. Such attacks typically aim to drain digital assets from victims' wallets by harvesting authentication details through fraudulent login portals or fake wallet updates. Given the irreversible nature of cryptocurrency transactions, this threat poses significant financial risk to users who interact with the domain. Analysis indicates phantomcash.digital was registered through QWINS-LTD (ASN: 213702) and currently resolves to the IP address 95.164.123.157, located in Germany under the same autonomous system. The domain appears on one security blocklist and is flagged by 12 out of 95 security vendors on VirusTotal, with detections including phishing, malicious URL, and brand impersonation. Notably, the domain lacks an SSL certificate, a red flag for users expecting encrypted connections on financial or cryptocurrency-related sites. Infrastructure analysis reveals the domain is now offline, but historical activity and registration details remain relevant for threat correlation. Users who visited phantomcash.digital or entered credentials on the site should assume their wallet information has been compromised. Immediate actions include revoking access to any connected applications, transferring assets to a new wallet, and monitoring transaction histories for unauthorized activity. If private keys or recovery phrases were exposed, the original wallet should be considered fully compromised and abandoned. Users are advised to report the incident to their wallet provider and relevant cybersecurity authorities to aid in tracking and mitigating further threats. Additionally, scanning local devices for malware is recommended, as phishing sites may deploy additional payloads to maintain persistence or exfiltrate data.