phantomsurfers[.]com

Analysis of phantomsurfers.com shows a high‑risk brand‑impersonation infrastructure targeting the Phantom brand with a crypto‑scam payload. The domain was registered through GoDaddy.com, LLC on February 21, 2026 and is currently active. DNS resolution points to IP address 50.87.144.182, which belongs to AS46606 Unified Layer located in the United States. The hosting environment uses HostGator nameservers (ns6291.hostgator.com and ns6292.hostgator.com).

An SSL certificate issued by Sectigo Limited, under the Sectigo Public Server Authentication CA DV R36, is present, indicating that transport‑layer encryption is in place but does not mitigate the malicious intent. HTTP requests receive a 302 redirect, and the page title returned is "404 Error," suggesting a potentially deceptive landing page. Reputation services flag the domain: VirusTotal reports 15 of 93 security vendors marking it as malicious, and three independent blocklists have listed it. Additional defensive products—PhishDestroy, MetaMask, and SEAL—have already blocked the domain.

The Gridinsoft trust score is 0 out of 100, reinforcing the assessment of zero trust. While the exact content of the landing page has not been publicly disclosed, the combination of brand impersonation, crypto‑scam classification, and the observed technical indicators confirms a hostile operation. Defenders should continue to block the domain at network perimeters, update endpoint and browser security filters, and monitor related DNS queries for the associated IP and nameserver patterns. Further investigation of the redirect behavior and any payload delivery mechanisms is recommended to fully characterize the threat vector.