phantomwallett--secures[.]framer[.]ai

Analysis of the domain phantomwallett--secures.framer.ai shows a clear alignment with a brand‑impersonation campaign targeting Phantom users. The site is hosted on Amazon Web Services (AS16509) in the United States and resolves to IP address 35.71.142.77. The domain was registered on 6 January 2018 through CSC Corporate Domains, Inc., and it employs a Let’s Encrypt certificate (issuer E8) that provides TLS encryption and HSTS enforcement. Technical fingerprinting reveals the use of Framer Sites, React, and HTTP/3, confirming that the infrastructure is built on a modern web‑app stack rather than a static phishing landing page.

The domain is served by four AWS Route 53 nameservers (ns-114.awsdns-14.com, ns-1198.awsdns-21.org, ns-1902.awsdns-45.co.uk, ns-635.awsdns). HTTP requests return a 404 status code and the page title is “Site Not Found | Framer,” indicating that the content has been removed or the site is deliberately taken offline. Despite the removal, the domain remains listed on at least one security blocklist and is flagged by PhishDestroy, providing external confirmation of malicious intent. VirusTotal reports a single detection out of ninety‑five scanners, reinforcing the suspicion without establishing a definitive verdict.

The known scam type is a crypto‑related impersonation, but the exact payload or credential‑harvesting mechanism has not been captured. Defenders should continue to block the hostname and associated IP address at network perimeter devices, monitor DNS queries for the listed nameservers, and add the domain to internal threat‑intel feeds. Because the site is currently offline, ongoing surveillance is advised to detect any re‑activation or migration to new infrastructure.