phantew[.]info

Phantew.info is actively distributing a crypto drainer designed to siphon cryptocurrency from unsuspecting users. This threat mimics legitimate services to trick victims into connecting their wallets, where malicious smart contracts silently drain funds. The domain leverages social engineering tactics, often disseminated via fake airdrop announcements or fraudulent giveaways, to lure users into approving malicious transactions. Once connected, the drainer executes unauthorized transfers, exploiting wallet permissions without raising immediate suspicion. This domain exhibits multiple red flags across security platforms. VirusTotal reports a 3/95 detection ratio, indicating limited but notable coverage by security vendors. It was registered through PDR Ltd. d/b/a PublicDomainRegistry.com and went live on April 28, 2026, suggesting a recently deployed campaign. Additionally, phantew.info is blocked by MetaMask and SEAL, and it appears on 2 security blocklists, further validating its malicious intent. The domain also holds a Let’s Encrypt SSL certificate, which may mislead users into believing it’s trustworthy. If you’ve visited phantew.info or interacted with its pages, disconnect your wallet immediately and revoke any suspicious permissions via tools like Etherscan’s token approval checker. Do not approve any further transactions from this domain. Report the incident to your wallet provider and consider transferring remaining funds to a new wallet. Stay vigilant for unusual transaction activity and avoid clicking links from unsolicited messages or advertisements.