phantomwalletextensiondownload[.]blogspot[.]co[.]ke

The domain phantomwalletextensiondownload.blogspot.co.ke poses a significant threat through brand impersonation. This site attempts to mimic a legitimate Phantom wallet extension, potentially misleading users into downloading malicious software that could compromise their digital assets. Such impersonation scams are designed to extract sensitive information from unsuspecting users by posing as a trusted entity.

The analysis reveals that this domain was registered through Google with ASN 15169. Notably, 10 out of 95 security vendors have flagged this domain on VirusTotal, indicating that the threat is recognized by multiple security agencies. Additionally, the domain resolves to IP address 142.250.186.65, located in Germany under Google LLC's infrastructure (AS15169). It also appears on one security blocklist, which further emphasizes its potential risk.

Users who have visited this domain should immediately conduct a thorough security check on their devices. This includes running a comprehensive malware scan and monitoring for any unauthorized financial activity. It is crucial to avoid entering sensitive information on sites that are unfamiliar or flagged by security platforms. Staying informed about current threats and verifying site authenticity can help prevent such impersonation scams.