setval[.]top

This domain operates as a credential harvesting site designed to impersonate Phantom, a cryptocurrency wallet service. The site presents a fraudulent interface mimicking Phantom's login or recovery process, aiming to deceive users into entering sensitive credentials such as private keys, seed phrases, or wallet passwords. Given the irreversible nature of cryptocurrency transactions, compromised credentials could lead to immediate and total asset loss. The site may also distribute malware under the guise of wallet software updates or recovery tools, further compromising user devices and connected services. Analysis indicates this domain was registered on November 30, 2025, through Web Commerce Communications Limited, a registrar commonly associated with newly spun-up malicious infrastructure. The domain currently resolves to IP address 172.67.222.143, hosted on Cloudflare's network (AS13335), which is frequently leveraged by threat actors to obscure origin servers and evade takedowns. Notably, the site lacks an SSL certificate, a red flag for any financial or authentication service. On VirusTotal, 10 out of 95 security vendors detect the domain as malicious, with detections ranging from phishing to cryptocurrency scam classifications. The page title displays 'Valorant,' a likely attempt to mislead automated crawlers or users into believing the site is related to the popular game rather than a wallet service. Users who have visited setval.top or entered any information on the site should assume their credentials are compromised. Immediately revoke access to any connected wallets and transfer remaining assets to a new, secure wallet using a clean device. Do not reuse passwords or seed phrases. Scan the device used to access the site with updated security software to detect potential malware infections. Monitor all linked accounts, including email and exchange platforms, for unauthorized activity. Report the incident to relevant blockchain security teams and consider filing a report with local cybercrime authorities. Avoid interacting with any communications claiming to be from Phantom or recovery services originating from this domain, as they are almost certainly fraudulent follow-up attempts.