phantomwalletextensiondownload[.]blogspot[.]ru

Analysis indicates that the domain phantomwalletextensiondownload.blogspot.ru is actively serving a malicious site that claims to offer a "Phantom wallet extension download" and impersonates the Phantom brand. DNS resolution points to IP 142.250.186.97, an address owned by Google LLC (ASN 15169) located in Germany, and the site presents a valid Google Trust Services SSL certificate (WE2). An HTTP request returns a 302 redirect, suggesting the page forwards visitors to additional resources. Malware and phishing services have tagged the site as a high‑risk crypto scam; eleven of ninety‑five VirusTotal scanners have reported detections. The infrastructure runs on Blogger and leverages Java, Python, OpenGSE, Clipboard.js, and HTTP/3, confirming a typical web‑hosting stack rather than a bespoke command‑and‑control platform. The domain appears on one public blocklist and is already blocked by PhishDestroy, indicating that security communities have recognized the threat. Current intelligence does not reveal the exact payload or credential‑harvesting mechanisms beyond the brand‑impersonation claim, so further content analysis is required. Defenders should block the domain at network perimeter and DNS layers, monitor for outbound connections to the associated Google IP, and update detection signatures to include the observed redirect behavior and the specific page title. Continuous observation is advised to capture any evolution of the phishing kit or additional malicious redirects.