phyntam-wallet[.]webflow[.]io

This domain is flagged for brand impersonation targeting Phantom, a widely used cryptocurrency wallet for the Solana blockchain. The site mimics the official Phantom wallet interface, presenting itself as a legitimate platform for decentralized finance (DeFi) and non-fungible token (NFT) transactions. Users interacting with this domain risk exposure to crypto drainer attacks, where malicious scripts or fake login prompts could siphon funds from connected wallets without authorization. The threat is particularly acute for users who may mistake the site for the genuine Phantom service due to its identical page title and branding elements. Analysis indicates the domain was created on May 8, 2013, though its current malicious use appears to be a recent development. It is registered through MarkMonitor, Inc., a registrar commonly associated with both legitimate and fraudulent domains. Infrastructure analysis reveals the domain resolves to IP address 172.64.151.8, hosted on Cloudflare’s network (AS13335), which is frequently leveraged to obscure the true origin of malicious sites. Security vendors on VirusTotal flagged the domain, with 11 out of 95 detecting it as malicious. Additionally, the domain appears on one security blocklist and is currently offline, though its prior activity remains a concern. If you visited phyntam-wallet.webflow.io or entered any wallet credentials, take immediate action to secure your assets. Disconnect any active wallet sessions linked to the site and revoke permissions for suspicious dApps via your wallet’s settings. Scan connected devices for malware using updated security tools, as the site may have deployed malicious scripts. Monitor your wallet transactions for unauthorized activity and consider transferring funds to a new wallet if compromise is suspected. Report the domain to relevant security platforms to aid in broader threat mitigation efforts.