phantwl[.]info

Analysis of phantwl.info, created on 21 February 2026, shows that the domain resolves to the IPv4 address 162.241.85.150, which is allocated to AS46606 (Unified Layer) in the United States. The domain was observed by 14 of 95 VirusTotal scanners, indicating that a minority of security vendors have generated a detection for the host. It appears on a single publicly‑available blocklist and has been explicitly blocked by the PhishDestroy service. The TLS certificate in use is identified as R13; no further certificate details have been disclosed.

As of the reporting date, the domain is listed as offline, and no active HTTP response was captured. The available evidence points to a generic phishing operation, but the lack of a publicly‑retrievable page title, brand targeting information, or detailed payload description limits attribution of the specific phishing campaign. The short lifespan—registration in early 2026 and offline status by July 2026—suggests a fast‑flux or opportunistic deployment. Defenders should continue to monitor the associated IP address (162.241.85.150) for any resurgence, add the IP and domain to internal block lists, and ensure that any outbound traffic to the AS46606 network is inspected.

Because the domain has already been flagged by multiple vendors, existing URL filtering solutions that incorporate VirusTotal or community blocklists will likely block future resolutions. Organizations should also review authentication logs for any attempted credential submissions that reference the domain or its SSL fingerprint. In the absence of additional indicators such as malware hashes or command‑and‑control endpoints, the primary mitigation remains network‑level blocking and continued threat‑intel correlation.