phantomeextensionn[.]blogspot[.]com

Analysis of phantomeextensionn.blogspot.com, observed on July 24, 2026, indicates that the site was hosted on Google Blogger and is currently taken offline, returning an HTTP 404 status. The page title registered in the site metadata reads “Download Phantom Wallet Extension - Official Website,” directly referencing the Phantom brand and suggesting a crypto‑wallet download vector. SSL inspection shows the certificate was issued by Google Trust Services under the WE2 profile, confirming the use of Google’s public‑key infrastructure. Network resolution points to IP 64.233.180.132, which belongs to AS15169 Google LLC in the United States, consistent with the Blogger hosting environment.

The domain appears on a single security blocklist and is explicitly blocked by PhishDestroy, reinforcing its classification as malicious. VirusTotal scans recorded four detections out of ninety‑five vendors, providing independent confirmation of suspicious activity. Detected technologies include Blogger, Java, Python, OpenGSE, Clipboard.js, and HTTP/3, all of which are typical of a Blogger‑based infrastructure but do not, by themselves, confirm malicious intent. The site impersonates the Phantom brand, fitting the reported scam type of a crypto scam.

While the page content has not been captured, the combination of a brand‑specific title, a fraudulent download prompt, blocklist inclusion, and multiple vendor detections suggests a high likelihood of credential or malware harvesting aimed at cryptocurrency users. Defenders should ensure the domain is added to blocklists, enforce DNS filtering, and monitor for any resurgence of the host under alternative subdomains. Continuous re‑scanning of the domain and its associated IP is advised to detect any re‑activation or related infrastructure that may emerge.