phawtom-wollet[.]gitbook[.]io

This domain is flagged as a high-risk brand impersonation threat targeting Phantom, a Solana-based cryptocurrency wallet. The specific threat type involves fraudulent representation of the Phantom Wallet interface to deceive users into disclosing sensitive credentials or transferring digital assets under false pretenses. Analysis indicates the domain mimics legitimate wallet services, increasing the likelihood of successful social engineering attacks against cryptocurrency users. Infrastructure analysis reveals the domain phawtom-wollet.gitbook.io was created on March 30, 2014, and remains active under Cloudflare, Inc. registration. It resolves to the IP address 104.18.40.47 and uses an SSL certificate issued by Google Trust Services. VirusTotal reports 6 out of 95 security vendors have flagged this domain as malicious, with a page title closely resembling the legitimate Phantom Wallet site: 'Phantom Wallet | A friendly Solana wallet built for DeFi & NFTs | Phantom Wallet | A friendly Solana wallet built fo.' No blocklist entries or trust score deviations were observed beyond the VirusTotal detections. Mitigation steps specific to this brand impersonation threat include immediate domain blocking at the network perimeter and endpoint levels. Security teams should deploy indicators of compromise (IOCs) such as the domain phawtom-wollet.gitbook.io and IP 104.18.40.47 into SIEM rules, firewalls, and email security gateways to prevent access. Users should be educated to verify domain authenticity by checking for official branding, SSL certificate details, and URL structure before entering credentials. Cryptocurrency wallet holders are advised to enable multi-factor authentication and use hardware-based wallets for sensitive transactions to reduce exposure to credential theft.