phantomwallet[.]to

On 23 July 2026 analysts observed that the domain phantomwallet.to is hosted on a server located in the Netherlands (AS202412, Omegatech LTD) and resolves to 178.16.54.12. The domain was registered on 5 May 2025 through the Government of the Kingdom of Tonga and is delegated to the nameservers ns1.ddos-guard.net and ns2.ddos-guard.net. No TLS certificate is presented, indicating that HTTPS is not available. The page title returned by the HTTP response is “phantomwallet.to”, matching the domain name and providing no additional context.

The domain appears on two independent phishing blocklists and has been explicitly blocked by the PhishDestroy and ScamSniffer filters. VirusTotal scans show that 17 of 95 security engines flag the domain as malicious, reinforcing the blocklist findings. The observed activity is classified as a crypto‑related scam that impersonates the Phantom wallet brand, suggesting that any credential or private‑key capture attempts would target Phantom users. At the time of analysis the host responded with an HTTP status indicating the site is taken offline, which limits immediate payload delivery but does not eliminate the risk of re‑activation.

Current intelligence lacks details on the content served before takedown, so the exact phishing flow and any embedded malicious payload remain uncertain. Defenders should add phantomwallet.to to internal block and allow lists, monitor DNS queries for the domain and its associated nameservers, and enforce TLS inspection policies that would block any future HTTP connections to this host. Network‑level controls should also restrict outbound traffic to the identified IP address and ASN. Continuous threat‑intel feeds should be consulted for any re‑registration attempts or new indicators tied to the same infrastructure.