backup[.]protect-phantom[.]com

This domain, backup.protect-phantom.com, is identified as a credential-theft phishing site specifically targeting users of the Phantom cryptocurrency wallet. Analysis indicates the site operated under the guise of a legitimate backup or security service for Phantom, a well-known digital wallet provider, to deceive victims into disclosing sensitive authentication credentials. The domain is currently offline, though prior activity suggests it was actively harvesting wallet recovery phrases, private keys, or login credentials. Infrastructure analysis reveals the domain was registered on November 8, 2025, through Name SRS AB, a registrar previously associated with abuse reports. It resolved to the IP address 188.114.97.3, part of AS13335 Cloudflare, Inc., a network frequently leveraged by threat actors to obfuscate malicious infrastructure. The site lacked an SSL certificate, increasing the likelihood of interception of transmitted data. Detection metrics indicate broad recognition of the threat: 9 of 95 security vendors on VirusTotal flagged the domain as malicious, while Google Safe Browsing classified it as phishing. The domain appears on one security blocklist and was actively blocked by PhishDestroy, further corroborating its malicious intent. Current status shows the domain as offline, though residual risk remains due to potential re-activation or migration to similar infrastructure. Users who accessed the site prior to takedown should immediately revoke any active sessions, rotate credentials, and monitor associated accounts for unauthorized transactions. Organizations should update blocklists to include this domain and its resolved IP, and consider implementing DNS-based protections to prevent access to newly registered lookalike domains. Cryptocurrency wallet providers are advised to issue warnings to users regarding phishing campaigns impersonating their services, particularly those leveraging terms like 'backup' or 'protect' in subdomains.