VirusTotal
9 / 92 engine detections
रिपोर्ट खोलें“Coming Soon”
क्रिप्टो वॉलेट ड्रेनर: gate-phantom.icu — सामग्री अनुपलब्ध. साक्ष्य सारांश: VirusTotal 9/92 (alphaMountain.ai, BitDefender, CRDF, Forcepoint ThreatSeeker…
मूल फॉरेंसिक रिकॉर्ड सुरक्षित रखने के लिए नीचे का विस्तृत PhishDestroy AI विश्लेषण अंग्रेज़ी में रखा गया है।
9 / 92 engine detections
रिपोर्ट खोलें2 det.
रिपोर्ट खोलेंSuspicious
रिपोर्ट खोलेंDBL_SPAM
4 community references
रिपोर्ट खोलेंNo threat flag
रिपोर्ट खोलेंNo malicious flag
रिपोर्ट खोलेंResults reflect each source’s collection time. Zero detections do not guarantee safety. OTX references are community publications.
PhishDestroy threat report
gate-phantom.icu is an impersonation phishing page built around the Phantom brand and aimed at people who use Phantom to hold Solana assets. PhishDestroy first saw it on 2026-10-10. The site has been offline since 2026-10-17, and its DNS was still inactive when last checked on 2026-10-19.
The domain pairs Phantom's name with a "gate" prefix, a common framing for fake claim, airdrop or verification portals. It is tied to a Solana Drainer kit. Kits like this prompt the visitor to connect their wallet and sign transactions or approvals that hand control of tokens and NFTs to the attacker, who then sweeps the wallet. The live page carried the title "Coming Soon", while we classify the domain as Phantom impersonation backed by drainer tooling.
Nine of 92 VirusTotal engines flagged the domain as of 2026-10-16. The flagging vendors include alphaMountain.ai, BitDefender, CRDF, Forcepoint ThreatSeeker, Fortinet, G-Data, Gridinsoft and Kaspersky. That is a modest count, but it comes from several unrelated vendors. Beyond PhishDestroy, the domain sits on the MetaMask and SEAL blocklists, two crypto-focused sources that track wallet threats specifically. Spamhaus lists it in its DBL as spam, and four AlienVault OTX pulses reference it.
The domain was registered on 2026-10-08 through NICENIC INTERNATIONAL GROUP CO., LIMITED and was already on our radar two days later. That short gap fits a throwaway domain stood up for a quick campaign. Traffic ran through Cloudflare's network (AS13335, US), so the visible IP belongs to the proxy rather than the operator's own server. The site used a free Let's Encrypt certificate, so a padlock in the browser said nothing about whether it was legitimate.
If you connected a Phantom or other Solana wallet to this site, check its connected apps and revoke any permissions you don't recognize. If you signed anything, move your remaining assets to a newly created wallet with a fresh seed phrase. Treat any seed phrase you typed into the page as compromised and stop using that wallet entirely. Remember that Phantom never asks for your recovery phrase through a website. Defenders should block the domain and look for other recently registered lookalikes that combine "phantom" with words like "gate", "claim" or "verify".
Last checked
The linked repository preserves daily zone observations across seven ShortDot-operated TLDs, including registration volume and abuse-related indicators. This registry context is supporting background and is not an independent detection for the domain in this report.
For this gTLD, the registrar above operates under an ICANN accreditation agreement. The links below provide the official fee schedule and current DNS abuse compliance guidance.
RAA §3.18 establishes abuse-contact and handling requirements. This report can document stored outbound notices and later technical observations; it does not by itself establish receipt, investigation, remediation, or contractual non-compliance.
एज-आईपी प्रतिष्ठा इस डोमेन के लिए जिम्मेदार नहीं है।
kami.ns.cloudflare.comsevki.ns.cloudflare.comLocation describes the IP network.
7a26e6127479a0946b1983134faa5d9863900c58dd1fa84cf293acef44a91970Saved certificate metadata. Certificate dates without a timezone are shown as stored. Transport encryption does not establish that the site is trustworthy.
Google PageSpeed Insights — mobile performance audit of gate-phantom.icu · checked Oct 12, 2026
An estimated time describes an observation window. It does not prove a registrar action or the exact moment a site became unavailable.
Dated changes retained by the monitor and source collectors. Newest observations appear first; source states are not proof of a takedown.
अज्ञात→dns_inactive
dns_nxdomain
अज्ञात→dns_inactive
dns_nxdomain
अज्ञात→dns_inactive
dns_nxdomain
पहुँच योग्य→अनुपलब्ध
अज्ञात→dns_inactive
dns_nxdomain
अनुपलब्ध→पहुँच योग्य
पहुँच योग्य→अनुपलब्ध
अज्ञात→live_content
content_served
अनुपलब्ध→पहुँच योग्य
पहुँच योग्य→अनुपलब्ध
अज्ञात→live_content
content_served
अनुपलब्ध→पहुँच योग्य
पहुँच योग्य→अनुपलब्ध
अज्ञात→live_content
content_served
अज्ञात→live_content
content_served
अज्ञात→live_content
content_served
अज्ञात→live_content
content_served
पहुँच योग्य
9/92 engine detections
View sourceNo threat flag
View source4 community references
View sourcePD-20261010-A88629
gate-phantom.icu
View sourcePage captured
View source3 संग्रहीत मिलते-जुलते डोमेन
Compare what a browser and a crawler receive, and check for Keitaro traffic routing.
gate-phantom.icu
PD-20261010-A88629 Recipient: abuse@gen.xyz Registrar: NICENIC International Group Co., Limited (Hong Kong (China)) Policy Violations: “Services may be used only for lawful purposes… fraud, abuse and illegal activity prohibited. Violations may result in immediate suspension.” + dedicated abuse handling and takedown Applicable Laws: Crimes Ordinance Cap.200 (Fraud), Theft Ordinance Cap.210 §16A (fraud by deception), Personal Data (Privacy) Ordinance Cap.486
यदि आपने इस डोमेन के साथ इंटरैक्ट किया है, व्यक्तिगत जानकारी दर्ज की है, या क्रिप्टोकरेंसी वॉलेट कनेक्ट किया है, तो तुरंत कार्रवाई करें। घटना की रिपोर्ट करने और अपनी सुरक्षा करने में आपकी सहायता के लिए नीचे संसाधन दिए गए हैं।
आधिकारिक साइबर अपराध संपर्क, या एक शिकायत ड्राफ्ट बनाएं → प्राप्त करने के लिए अपना देश चुनें।
Template-based draft · optional AI wording assistance requires separate consent
Choose the steps that match what you shared. Keep a copy of this report alongside your own records.
एक अनुमानित $51 billion 2024 में अवैध क्रिप्टो वॉलेट्स में प्रवाहित हुआ (source). यदि आपने के साथ इंटरैक्ट किया था gate-phantom.icu — अभी कार्रवाई करें।
Wallet-specific steps below apply if you connected a wallet, signed a transaction, or exposed a wallet secret.
Stop using the suspicious site. Open the real service through its official app or an address you already trust.
के अनुसार एफबीआई, सबसे महत्वपूर्ण विवरण लेनदेन डेटा हैं:
0x5856...35985)gate-phantom.icu)भले ही आपके पास सभी विवरण न हों — फिर भी रिपोर्ट दर्ज करें. आंशिक जानकारी अभी भी जांच में मदद करती है।
A report is not a guarantee of recovery or investigation, but prompt, accurate transaction data can help authorities and service providers trace the incident.
Further guidance: NIST · phishing responseFBI IC3 · reports & evidenceFTC · recovery scams
संग्रहीत ब्लॉकलिस्ट, WHOIS, DNS और सार्वजनिक स्कैन साक्ष्य का उपयोग करके खतरे का विश्लेषण
अभी स्कैन करेंसंदिग्ध डोमेन हमारे थ्रेट डेटाबेस में जमा करें — समुदाय की सुरक्षा करें
रिपोर्ट करेंहाल की फ़िशिंग रिपोर्टें और उपलब्धता में परिवर्तन देखे गए
निगरानी करेंलाइव खतरों की निगरानी करें या यदि आपको लगता है कि यह एक गलत सकारात्मक है तो इस लिस्टिंग को चुनौती दें।
This report combines saved page captures, registration and network records, scanner results and PhishDestroy reporting history. Each source keeps its own observation date. Open a source report to inspect the original result.
The AI-assisted analysis was written on . It describes the evidence available at that time; later source checks can change.
A capture documents what was shown. A scanner result records that provider’s assessment at the time of its check. Neither a valid certificate nor a zero-detection result is a guarantee of safety.