phanttomwallolet[.]created[.]app

Analysis of phanttomwallolet.created.app shows a domain that was created on 12 July 2023 and is currently offline, returning HTTP 404. The domain is registered through Tucows Domains Inc. and uses Vercel DNS (ns1.vercel-dns.com, ns2.vercel-dns.com). DNS resolution points to IP 216.150.1.129, an Amazon Web Services host (AS16509) located in the United States. The TLS certificate is issued by Let’s Encrypt (R13) and includes HSTS, indicating the site was served over HTTPS when active.

Detected infrastructure components include Google Cloud, Vercel, LaunchDarkly, and Google Cloud CDN, all consistent with a modern web‑app hosting stack. The page title captured from the site, “Phantom Wallet® - Buy and Sell Bitcoin, Ethereum, and more,” directly references the legitimate Phantom cryptocurrency wallet brand, confirming a brand‑impersonation intent. The intelligence classifies the activity as a crypto‑scam, and the domain appears on the PhishDestroy blocklist, the only listed security blocklist. VirusTotal scans flagged the domain on 12 of 95 engines, providing independent corroboration of malicious behavior.

Evidence confirms that the domain was used to mimic the Phantom brand and likely to lure cryptocurrency users, but the site is presently taken down, limiting immediate threat exposure. Uncertainty remains regarding the exact payload or credential‑harvesting mechanisms that may have been hosted before takedown, as no page content beyond the title is available. Defenders should continue to block the domain at network perimeter and DNS layers, monitor for any re‑registration attempts, and update threat‑intel feeds with the observed indicators (IP address, nameservers, SSL fingerprint, and blocklist entry). Additional scrutiny of any traffic targeting the associated IP range is advised, as the host may serve other malicious assets.