phantom-dev[.]fucked-your[.]mom

phantom-dev.fucked-your.mom was registered on February 21, 2026 through Spaceship, Inc. The domain resolves to the IP address 88.218.168.92, which is assigned to AS9123 JSC “TIMEWEB” in Russia. Both authoritative nameservers are Cloudflare (morgan.ns.cloudflare.com and veda.ns.cloudflare.com), indicating the use of Cloudflare’s DNS services. The site presented a page title of “Phantom Market,” aligning with a crypto‑scam classification that impersonates the Phantom brand. No TLS certificate was observed, meaning the site was served over plain HTTP. Automated scanning on VirusTotal recorded three positive detections out of ninety‑three security vendors, confirming that at least a subset of AV engines flagged the domain as malicious.

The domain appears on three external blocklists and has been added to the blocklists of PhishDestroy, MetaMask, and SEAL, demonstrating that multiple defensive products have taken action against it. Current HTTP response status indicates the host is taken offline, so active probing is not possible at the time of writing. Analysis indicates that the infrastructure is typical of fast‑flux or short‑lived campaigns: a recent registration, a single IP address hosted in a Russian data centre, and reliance on Cloudflare DNS to provide resilience. The lack of SSL further reduces trust for legitimate users but also suggests the operators did not prioritize encryption.

While the page title and brand claim provide a clear indication of intent, the exact content of the landing page has not been captured, leaving the visual vector uncertain. Defenders should continue to block the domain at DNS and proxy layers, monitor the associated IP address for any re‑activation, and add the domain to internal threat‑intel feeds. Given the presence on multiple blocklists and the positive VirusTotal detections, security products that rely on reputation should already be flagging connections to this host.