app[.]phanpay[.]io

This domain, app.phanpay.io, is designed to impersonate Phantom, a popular cryptocurrency wallet service. The site displays a fraudulent interface prompting users to "Connect Your Phantom Wallet," a tactic used to harvest sensitive credentials, private keys, or seed phrases. Once entered, these details can be exploited to drain digital assets from victims' wallets. The threat is particularly deceptive due to its professional appearance, mimicking legitimate wallet connection flows commonly used in decentralized applications. Analysis indicates this domain was registered on May 10, 2026, through Dynadot Inc, a registrar frequently associated with newly created malicious infrastructure. It resolves to the IP address 94.183.168.68, which has been flagged by 18 out of 95 security vendors on VirusTotal. The domain appears on at least one security blocklist and has a Gridinsoft trust score of 0/100, further confirming its malicious nature. The page title, "PhanPay — Connect Your Phantom Wallet," explicitly targets Phantom users, leaving little doubt about its intent. If you visited app.phanpay.io and connected your wallet or entered any sensitive information, immediate action is required. Disconnect the wallet from all dApps via your Phantom settings and revoke any suspicious permissions. Transfer remaining assets to a new, secure wallet using a fresh seed phrase. Monitor your original wallet for unauthorized transactions and report the incident to the platform you used to access the site. Additionally, scan your device for malware, as phishing sites may deploy additional payloads. Users should verify domain authenticity before interacting with any wallet connection prompts, ensuring the URL matches the official service.