phantomvxcx[.]it[.]com

Analysis of the domain phantomvxcx.it.com indicates it was involved in a crypto scam operation impersonating Phantom, a known cryptocurrency wallet brand. The domain, registered through Intis Telecom LTD on October 23, 1992, exhibits characteristics consistent with brand impersonation campaigns. Infrastructure analysis reveals the domain resolved to the IP address 172.67.206.147, hosted under AS13335 (Cloudflare, Inc.) in the United States. Nameserver records include margo.ns.cloudflare.com alongside ns1.it.com, ns2.it.com, and ns3.it.com, suggesting a hybrid DNS configuration potentially leveraged to evade detection or takedown efforts.

Security vendor detections on VirusTotal flagged the domain as malicious, with 8 out of 93 vendors identifying it as a threat. The domain appears on two security blocklists, including PhishDestroy and ScamSniffer, further corroborating its association with fraudulent activity. No SSL certificate was present at the time of assessment, which is atypical for legitimate financial or crypto-related services and may have served as an additional red flag for security tools. The page title, recorded as phantomvxcx.it.com/#/, does not provide additional context beyond the domain name itself, and no further content analysis is available.

The domain has since been taken offline, though its historical registration date—October 23, 1992—is anomalous for a campaign of this nature, potentially indicating domain repurposing or registry inaccuracies. Defenders are advised to monitor for re-registration or similar domains under the same registrar or hosting provider. Given the elevated risk level, organizations should ensure blocklist updates include this domain and consider proactive detection for related infrastructure patterns, such as Cloudflare-hosted domains with crypto-related keywords or Phantom brand impersonation.