VirusTotal
9 / 91 engine detections
レポートを開く“Service unavailable”
暗号資産ウォレットドレイナー: eng-phantomwallet.com — 最後に確認されたアクティブな状態 (HTTP 200). 証拠の概要: VirusTotal 9/91 (alphaMountain.ai, BitDefender, Forcepoint ThreatSeeker, Fortinet…
元のフォレンジック記録を保持するため、下の PhishDestroy AI 詳細分析は英語のままです。
9 / 91 engine detections
レポートを開くDBL_SPAM
1 community reference
レポートを開くScan report
レポートを開くNo threat flag
レポートを開くNo malicious flag
レポートを開くResults reflect each source’s collection time. Zero detections do not guarantee safety. OTX references are community publications.
PhishDestroy threat report
eng-phantomwallet.com is a crypto drainer site built to impersonate Phantom, the widely used Solana wallet. It targets Solana users by presenting a convincing fake of the legitimate Phantom interface, tricking them into connecting their wallets. PhishDestroy first identified it on 2026-10-03, just three days after registration. As of 2026-10-18 the site remains alive and serving live content.
The site deploys a Solana Drainer kit, a class of malicious tooling designed to request broad token-spending approvals or direct asset transfers the moment a visitor connects their wallet. Once authorization is granted, the kit sweeps tokens and SOL from the victim's wallet automatically, often within seconds. The page title currently reads "Service unavailable", which conflicts with the live-content classification; the site is nonetheless confirmed active and dangerous.
VirusTotal returned 9 detections from 91 scanning engines as of 2026-10-05, with flagging vendors including Kaspersky, BitDefender, Fortinet, G-Data, Gridinsoft, Forcepoint ThreatSeeker, SOCRadar and alphaMountain.ai. The domain appears on three blocklists — PhishDestroy, MetaMask and SEAL — meaning wallet software is already actively warning users. Spamhaus classifies it as DBL_SPAM, and it has been picked up by one OTX threat-intelligence pulse.
The domain was registered on 2026-09-30 through NICENIC INTERNATIONAL GROUP CO., LIMITED, giving it less than a week of existence before PhishDestroy flagged it. It is hosted on Cloudflare's network (AS13335) in the United States at IP 104.21.58.106. TLS is provided by Let's Encrypt (issuer YE1), a free certificate authority commonly used for rapid, low-cost site deployment.
If you visited this site but did not connect a wallet, no immediate action is required beyond avoiding any return visit. If you connected a wallet, immediately revoke all token approvals granted to any contract associated with this site using a trusted approval-management tool, then transfer remaining assets to a fresh wallet address. If you entered a seed phrase or private key anywhere on the site, consider that wallet fully compromised and move all funds out immediately. Security teams and wallet providers should add eng-phantomwallet.com to blocklists and alert Solana users; the MetaMask and SEAL blocklists already carry this entry.
Last checked
Edge-IP の評判はこのドメインに起因しません。
howard.ns.cloudflare.comLocation describes the IP network.
592f578a66ab3f403a0d43a12fac85c227ad17b1d593d1ee93321120e450a182Saved certificate metadata. Certificate dates without a timezone are shown as stored. Transport encryption does not establish that the site is trustworthy.
An estimated time describes an observation window. It does not prove a registrar action or the exact moment a site became unavailable.
Compare what a browser and a crawler receive, and check for Keitaro traffic routing.
alive_content: raw=ok; http=200; via=https_proxy; server=cloudflare
eng-phantomwallet.com
Dated changes retained by the monitor and source collectors. Newest observations appear first; source states are not proof of a takedown.
不明→live_content
content_served
不明→live_content
content_served
不明→live_content
content_served
不明→live_content
content_served
不明→live_content
content_served
不明→live_content
content_served
不明→live_content
content_served
不明→live_content
content_served
不明→live_content
content_served
不明→live_content
content_served
不明→live_content
content_served
不明→live_content
content_served
不明→live_content
content_served
不明→live_content
content_served
No threat flag
View source9/91 engine detections
View source1 community references
View sourceeng-phantomwallet.com
View source保存された類似ドメイン:3 件
Listed domains receive at least one abuse report; this entry has no retained notification history.
このドメインを操作したり、個人情報を入力したり、暗号通貨ウォレットに接続したりした場合は、直ちに行動を起こしてください。インシデントを報告し、自分自身を守るのに役立つリソースを以下に示します。
サイバー犯罪の公式連絡先 または 苦情草稿を作成する → を取得するには、国を選択してください。
Template-based draft · optional AI wording assistance requires separate consent
Choose the steps that match what you shared. Keep a copy of this report alongside your own records.
推定では $51 billion 2024年に違法な暗号資産ウォレットへと流出した(source). もしあなたが eng-phantomwallet.com — 今すぐ行動しましょう。
Wallet-specific steps below apply if you connected a wallet, signed a transaction, or exposed a wallet secret.
Stop using the suspicious site. Open the real service through its official app or an address you already trust.
によると、 FBI、最も重要な詳細はトランザクションデータです:
0x5856...35985)eng-phantomwallet.com)たとえすべての詳細がわかっていなくても―― とにかく報告を提出する. 不完全な情報であっても、捜査には役立つ。
A report is not a guarantee of recovery or investigation, but prompt, accurate transaction data can help authorities and service providers trace the incident.
Further guidance: NIST · phishing responseFBI IC3 · reports & evidenceFTC · recovery scams
保存されたブロックリスト、WHOIS、DNS、および公開スキャン証拠を使用した脅威分析
今すぐスキャン不審なドメインを当社の脅威データベースに報告してください — コミュニティを守りましょう
レポート最近のフィッシングレポートと観察された可用性の変化
監視リアルタイムの脅威を監視するか、誤検知だと思われる場合はこのリストに異議を申し立ててください
This report combines saved page captures, registration and network records, scanner results and PhishDestroy reporting history. Each source keeps its own observation date. Open a source report to inspect the original result.
The AI-assisted analysis was written on . It describes the evidence available at that time; later source checks can change.
A capture documents what was shown. A scanner result records that provider’s assessment at the time of its check. Neither a valid certificate nor a zero-detection result is a guarantee of safety.