web-phantom[.]at

The domain web-phantom.at is identified as a brand impersonation threat specifically targeting Phantom, a cryptocurrency wallet provider. This domain was designed to deceive users into believing they were accessing legitimate Phantom wallet services, likely for the purpose of credential theft or crypto asset compromise. As of the latest verification, the domain has been taken offline, though prior activity remains a documented risk. Analysis indicates the domain was flagged by 20 of 95 security vendors on VirusTotal, signaling broad detection as malicious. Infrastructure analysis reveals the domain was registered through Key-Systems GmbH and resolved to the IP address 185.221.215.64, hosted under AS62082 (Hostland LTD) in Russia. The SSL certificate was issued by Let's Encrypt (R13), a common choice for both legitimate and malicious domains. The page title, 'Phantom Wallet | Download Extension | Crypto,' directly mirrors the branding of the legitimate Phantom service. The domain appears on one security blocklist and was previously blocked by PhishDestroy, further corroborating its malicious classification. Current status confirms the domain is offline, though historical indicators remain relevant for threat hunting and detection. Organizations and individuals are advised to block the domain and associated IP (185.221.215.64) at the network perimeter. Users who may have interacted with the domain should revoke any active sessions, reset credentials, and monitor accounts for unauthorized transactions. Security teams should review logs for connections to the domain or IP and correlate with other indicators of compromise. Proactive monitoring for similar impersonation domains using Phantom branding is recommended.