phantom-walletapps[.]framer[.]ai

This domain, phantom-walletapps.framer.ai, is identified as a high-risk crypto drainer operation targeting users of the Phantom wallet service. Analysis confirms the deployment of a Solana-based drainer kit, designed to illicitly siphon cryptocurrency assets from victims under the guise of a legitimate wallet interface. The campaign leverages brand impersonation to deceive users into connecting their wallets, enabling unauthorized transactions through malicious smart contract interactions. Infrastructure analysis reveals the domain was registered through CSC Corporate Domains, Inc. on January 6, 2018, though repurposed for malicious activity. It resolves to the IP address 52.223.52.2 and is currently flagged by 3 out of 95 security vendors on VirusTotal. The domain appears on one security blocklist and is actively blocked by at least one threat intelligence feed. The SSL certificate is issued by Let's Encrypt, and the site employs technologies including Framer Sites, React, HSTS, and HTTP/3, which may be used to lend an appearance of legitimacy. As of the latest assessment, phantom-walletapps.framer.ai has been taken offline, likely due to enforcement actions or infrastructure disruption. However, the underlying threat persists, as similar domains may emerge using comparable tactics. Users are advised to verify wallet connections exclusively through official sources and to scrutinize domain authenticity before interacting with any cryptocurrency-related service. The presence of a single blocklist entry and limited vendor detections underscores the need for continuous monitoring of such campaigns, as they often evade detection during initial deployment phases.