phantomwalletdownload[.]blogspot[.]ro

The domain phantomwalletdownload.blogspot.ro is currently active and classified as a high‑risk brand‑impersonation campaign targeting the Phantom cryptocurrency wallet. Infrastructure analysis shows the domain resolves to IP 142.250.186.161, which belongs to Google LLC (ASN 15169) and is geolocated in the United States. The site presents a valid SSL certificate issued by Google Trust Services under the WE2 designation, and the HTTP response is a 302 redirect, indicating a possible staging or credential‑harvesting step. Detected technologies include Blogger hosting, Java, Python, OpenGSE, and HTTP/3, suggesting the use of a multi‑component delivery chain. The page title "Phantom Wallet Download" aligns with the claimed impersonation of the Phantom brand. VirusTotal reports that 8 of 95 security vendors flag the domain as malicious, and the domain is listed on at least one public blocklist and has been blocked by the PhishDestroy feed. While the exact payload or credential‑capture mechanism has not been publicly observed, the combination of brand‑specific title, redirect behavior, and vendor detections strongly indicates a phishing or malware distribution intent. Defenders should immediately block network resolution to 142.250.186.161 for this hostname, add the domain to URL filtering policies, and monitor outbound connections for HTTP/3 traffic to Google‑hosted infrastructure that may be leveraged for malicious redirects. Continuous scanning with updated sandbox environments is recommended to capture any evolving payloads, and alerts should be generated for any attempts to access the domain or retrieve resources from the associated IP address.