phantom-wallet[.]blogspot[.]co[.]il

The domain phantom-wallet.blogspot.co.il is currently active and has been identified as a high‑risk impersonation of the Phantom cryptocurrency wallet. The site’s page title explicitly reads “Phantom Wallet - A friendly Crypto Wallet,” matching the targeted brand and confirming the intent to deceive users seeking legitimate Phantom services. Infrastructure analysis shows the domain is hosted on Google’s Blogger platform, using Google name servers ns1.google.com through ns4.google.com. DNS resolution points to IP 142.250.184.193, which belongs to AS15169 Google LLC located in the United States. The SSL certificate is issued by Google Trust Services under the “WE2” profile, providing a valid TLS chain but offering no protection against brand spoofing.

VirusTotal scans have flagged the domain by 11 of 93 security vendors, and the site appears on the PhishDestroy blocklist, reinforcing its malicious classification. The HTTP response is a 302 redirect, a technique often used to forward victims to a credential‑harvesting endpoint. Detected technologies include Blogger, Java, Python, OpenGSE, and HTTP/3, indicating a custom backend that may be employed to capture user inputs. The domain was registered through Domain The Net Technologies Ltd, a registrar that hosts both legitimate and malicious domains.

No public samples of the landing page content have been released, so the exact phishing flow, credential collection method, or any embedded malware remain unverified. Defenders should block the domain at perimeter filters, add it to internal blocklists, and monitor DNS queries for the associated IP and Google name servers. Email gateways should be configured to flag any external messages containing the domain or the phrase “Phantom Wallet.” Incident response teams should treat any credentials submitted to this domain as compromised and enforce credential rotation for affected users.