app-phantom-wallet[.]framer[.]ai

The domain app-phantom-wallet.framer.ai was observed hosting a site that returned an HTTP 404 response with the page title "Site Not Found | Framer". The host resolves to the Amazon‑owned IP address 52.223.52.2, AS16509, located in the United States, and presents a valid Let’s Encrypt certificate (CN=E8). DNS resolution is served by the AWS name servers ns-114.awsdns-14.com, ns-1198.awsdns-21.org, ns-1902.awsdns-45.co.uk and ns-635.awsdns. The domain was registered on 06 January 2018 through CSC Corporate Domains, Inc. Infrastructure analysis shows the use of Framer Sites, React, HTTP/3 and HSTS, indicating a modern web stack.

VirusTotal recorded eight positive detections out of ninety‑five scanners, and Google Safe Browsing classified the URL as a social‑engineering threat. The domain appears on a single security blocklist and has been blocked by the PhishDestroy feed. It is categorized as a "Crypto Scam" and explicitly impersonates the Phantom wallet brand. At the time of reporting (24 July 2026) the domain is offline, and no active landing page is available for further forensic capture.

Because the hosting environment is Amazon AWS, the same IP address could be reused for unrelated legitimate services, limiting confidence in attributing future activity solely to this campaign. Defenders should continue to block the domain and its resolved IP, monitor the registrar CSC Corporate Domains, Inc. for any new registrations that reuse the same name servers, and add the domain to threat‑intel feeds that track brand‑impersonation attempts against Phantom. Continuous observation of the IP range 52.223.52.0/24 is recommended to detect re‑deployment of the same infrastructure. The limited evidence, notably the 404 response and absence of a live payload, leaves the current operational status uncertain, but historical indicators justify maintaining an elevated risk posture.