phantom-wallet[.]duckdns[.]org

This domain, phantom-wallet.duckdns.org, is flagged for brand impersonation, a high-risk threat where malicious actors create a website that mimics a legitimate brand to deceive users. The impersonation is designed to trick visitors into revealing sensitive information or performing actions that could compromise their security.

Analysis indicates that phantom-wallet.duckdns.org was created on February 21, 2026, and has been flagged by 14 out of 95 security vendors on VirusTotal. The domain is registered through DuckDNS, a free dynamic DNS service, which can be a red flag as it is often used for temporary or illicit activities. Additionally, the domain resolves to an IP address, 103.186.31.94, located in Indonesia and is associated with AS141892 CV Andhika Pratama Sanggoro. The site also appears on three security blocklists, including PhishDestroy, MetaMask, and SEAL, further confirming its malicious nature.

If a user has visited this site, they should take immediate steps to ensure their security. First, they should change any passwords or sensitive credentials that may have been entered on the site. Users are advised to monitor their accounts for any unauthorized activity and to enable two-factor authentication (2FA) for added security. It is also recommended to run a full system scan using reputable antivirus software to detect and remove any potential malware. Users should report the incident to the legitimate brand, across, and to their respective financial institutions if any financial information was compromised.