phentamwalle[.]vercel[.]app

This domain, phentamwalle.vercel.app, poses a high-risk threat as a brand impersonation site specifically targeting users of the Phantom cryptocurrency wallet. The site presents a fraudulent interface labeled 'Phantom Wallet – Fast, Secure,' designed to deceive visitors into entering sensitive credentials or approving malicious transactions. Analysis indicates the domain functions as a crypto drainer, a type of attack that automatically siphons digital assets from connected wallets once permissions are granted. The page structure, visual elements, and language closely replicate the legitimate Phantom wallet interface, increasing the likelihood of successful deception among users unfamiliar with security indicators. Infrastructure analysis reveals multiple technical indicators supporting the malicious classification of this domain. The site is registered through Vercel Inc. and resolves to the IP address 64.29.17.67, hosted within the United States. The domain was created on April 28, 2026, though this date may reflect a falsified registration record or a placeholder. According to VirusTotal, 10 out of 95 security vendors have flagged phentamwalle.vercel.app as malicious, while the domain appears on three distinct security blocklists. The SSL certificate is issued by Google Trust Services under the WR1 root, a common but not exclusive indicator of legitimacy, often exploited by threat actors to lend false credibility to phishing sites. Users who have visited phentamwalle.vercel.app or interacted with its content should take immediate remedial action. Any credentials, recovery phrases, or wallet permissions granted to this domain must be considered compromised. Affected individuals should revoke all active wallet sessions, transfer remaining assets to a new, secure wallet, and monitor transaction histories for unauthorized activity. It is also recommended to scan local devices for malware, as crypto drainers may deploy additional payloads to maintain persistence. Due to the high-risk nature of this campaign, users are advised to verify domain authenticity through official channels before entering any sensitive information or connecting wallets to web-based interfaces.