phantomeextensionn[.]blogspot[.]fi

The domain phantomeextensionn.blogspot.fi is actively hosting a fraudulent page titled “Download Phantom Wallet Extension - Official Website” that purports to distribute a Phantom wallet browser extension. Registration details show the domain was created on 21 February 2026 and is registered through MarkMonitor, Inc., a registrar commonly associated with legitimate brand protection services, which may mislead investigators about its intent. The site resolves to 172.217.20.129, an IP owned by Google LLC (AS15169) located in the United States, and presents a valid SSL certificate issued by Google Trust Services under the WE2 profile, giving the connection a veneer of trustworthiness. HTTP requests return a 302 redirect, a pattern often used to hide the final malicious payload behind a temporary forwarding step.

Technical fingerprinting reveals the presence of Blogger as the underlying platform along with Java, Python, OpenGSE, and support for HTTP/3, indicating a mixed‑technology stack that does not match any known legitimate Phantom distribution channel. VirusTotal analysis shows 12 of 93 scanning engines flag the domain, and the domain appears on three external blocklists, with explicit blocks from PhishDestroy, MetaMask, and SEAL. These indicators collectively suggest a high‑risk crypto‑scam operation targeting users of the Phantom wallet.

Uncertainties remain regarding the exact payload delivered after the redirect and whether any additional command‑and‑control infrastructure is involved, as the page content has not been publicly dissected. Defenders should immediately block the domain at network perimeters, add it to endpoint allow‑list exclusions, and monitor for any outbound connections to the associated Google IP that may arise from compromised browsers. Continuous re‑scanning of the URL through sandbox environments is advised to capture the final payload and to update detection signatures accordingly.