phantomfix[.]netlify[.]app

phantomfix.netlify.app was observed hosting a page whose title reads “Phantom — Crypto & NFT Wallet — Solana | Ethereum | Polygon”, indicating an attempt to impersonate the Phantom cryptocurrency wallet. The domain is served via Netlify, as evidenced by the hosting provider tag and the presence of a Netlify‑generated TLS certificate issued by DigiCert Global G2. The certificate is valid for the domain and includes the standard DigiCert chain, confirming that the TLS handshake completes without certificate errors. An IPv6 address 2a05:d014:58f:6200::259 resolves to the domain; the address belongs to Amazon’s AS16509 network and geolocates to Germany, typical of Netlify’s edge infrastructure.

HTTP requests return a 404 status, suggesting the original content has been removed or the site is no longer serving the malicious page. VirusTotal reports that 13 of 95 scanners flagged the domain, indicating a moderate level of detection across anti‑malware engines. The domain appears on a single external blocklist and is listed as blocked by PhishDestroy, reinforcing its classification as malicious. The page title and the “Crypto Scam” label in the intelligence point to a financial fraud campaign targeting users of the Phantom wallet, likely attempting to harvest private keys or lure victims into fraudulent token transactions.

No additional indicators such as phishing form URLs, JavaScript payloads, or credential‑stealing scripts were captured in the available data, leaving the exact attack vector uncertain. Defenders should continue to block the domain at network perimeter and DNS layers, monitor for any resurgence of the address, and incorporate the observed TLS fingerprint and IPv6 prefix into threat‑intel feeds. Organizations using Phantom should educate users about unsolicited requests for wallet access and advise verification of URLs before any credential entry.