org--firef---o--x-addons[.]webflow[.]io

The domain org--firef---o--x-addons.webflow.io was observed hosting a page titled “Phantom wallet extension (Official Site)®”. The title explicitly references the Phantom brand, indicating a brand‑impersonation attempt aimed at cryptocurrency users. The site returned an HTTP 404 status, suggesting the content is no longer reachable, and it has been taken offline according to the latest scan on July 23 2026. Infrastructure analysis shows the domain resolves to the Cloudflare address 172.64.151.8, located in the United States and announced by AS13335 Cloudflare, Inc. The domain is served through Cloudflare and supports HTTP/3, consistent with the listed technologies. Registration data reveals the domain was created on 08 May 2013 and is registered through MarkMonitor, Inc., a registrar commonly used for legitimate brand protection.

The SSL certificate is issued by Google Trust Services under the WE1 authority, providing a valid TLS chain that may lend false credibility to the page. VirusTotal has recorded 13 detections out of 95 scanned engines, confirming that multiple security vendors consider the domain malicious. The domain appears on a single external blocklist and has been specifically blocked by PhishDestroy, reinforcing its classification as a crypto‑related scam. Evidence is limited to the page title, the brand reference, and the detection counts; no additional payload, phishing form, or malware samples have been publicly released.

Consequently, the exact technique used to lure victims (e.g., credential harvesting or wallet address substitution) remains unknown. Defenders should continue to block the domain at network perimeter and DNS layers, monitor for any future re‑registration, and add the domain to internal threat‑intel feeds. Users of the Phantom wallet should be warned that any unsolicited request originating from this URL is unauthorised and should be ignored.