phantom[.]restore-chain[.]com

phantom.restore-chain.com was registered on 11 October 2025 through the HOSTINGER operations, UAB registrar and is hosted on IP 82.29.199.132, which belongs to AS47583 Hostinger International Limited in the United States. The domain resolves to the generic parking nameservers ns1.dns-parking.com and ns2.dns-parking.com, and it does not present an SSL certificate, indicating that any traffic would be unencrypted. The only visible artifact is the page title “Phantom Restore”, which directly references the targeted brand “Phantom”. Security telemetry shows that 16 of 95 VirusTotal scanners flagged the domain as malicious, and it appears on a single external blocklist.

PhishDestroy has already taken the site offline, and the current status is reported as offline. Gridinsoft assigns a trust score of 0 out of 100, reinforcing the malicious assessment. The site is classified as a crypto‑scam that impersonates the Phantom brand, although no additional content has been captured to confirm the exact lure or victim flow.

Uncertainty remains around the specific phishing kit, the presence of any credential‑stealing forms, and whether the domain was ever served over HTTPS before takedown. Defenders should immediately add phantom.restore-chain.com to URL filtering and DNS block lists, monitor the hosting IP 82.29.199.132 for any new domains that may reuse the same infrastructure, and enforce strict TLS inspection policies to prevent accidental connections to non‑SSL endpoints. Continuous threat‑intel feeds should be consulted for any resurgence of the domain or related sub‑domains, and any alerts triggered by the 16 VirusTotal detections should be investigated for potential compromise of internal credentials.