portal-en-phantom[.]created[.]app

The domain portal-en-phantom.created.app is a high-risk crypto drainer that impersonates the Phantom brand. This domain is designed to steal cryptocurrency from users by tricking them into revealing their private keys or other sensitive information. The threat is particularly dangerous as it can lead to significant financial loss for victims.

Analysis indicates that this domain has been flagged by 7 out of 95 security vendors on VirusTotal, suggesting it has some level of malicious intent. The domain is registered through Tucows Domains Inc. and was created on July 12, 2023. Infrastructure analysis reveals that the domain resolves to the IP address 216.150.1.193 and uses Vercel for hosting. The presence of HSTS (HTTP Strict Transport Security) indicates an attempt to establish a secure connection, which can make the domain appear more legitimate to unsuspecting users. The domain also appears on 1 security blocklist, further confirming its malicious nature. The SSL certificate is issued by Let's Encrypt, a common choice for phishing sites due to its ease of use and credibility.

If users have visited portal-en-phantom.created.app, they should immediately check their cryptocurrency wallets for any unauthorized transactions. They should also update their device's security software to ensure it is capable of detecting and blocking similar threats. It is recommended to report any suspicious activity to their respective cryptocurrency service providers and consider changing any related passwords or private keys. Regularly monitoring account activity and using multi-factor authentication can help mitigate the risk of future attacks.