phantam[.]xyz

The domain phantam.xyz has been identified as a high-risk entity actively impersonating the brand Phantom. Registered on March 22, 2026, through Namecheap, this domain is currently active and is associated with a page titled "PHANTAM — Sovereign Memory." Infrastructure analysis reveals that phantam.xyz resolves to the IP address 76.76.21.21, which is currently under observation for malicious activities. The domain employs a Let's Encrypt SSL certificate, indicating a potential effort to appear legitimate to unsuspecting users.

Security assessments have flagged phantam.xyz on four distinct security blocklists, highlighting its malicious reputation. The domain has been detected in 23 threat intelligence pulses on AlienVault OTX, further corroborating its role in malicious branding activities. VirusTotal results indicate that 13 out of 95 security vendors have identified this domain as a threat, reinforcing concerns regarding its safety and legitimacy.

Defensive measures should be implemented immediately, as the Gridinsoft trust score for this domain stands at 0 out of 100, indicating a complete lack of trustworthiness. Additionally, this domain has been blocked by significant entities including SEAL, MetaMask, PhishDestroy, and BLP-Malware, reflecting its widespread recognition as a malicious actor. Given the ongoing active status and the brand impersonation tactic employed, organizations should monitor their networks for any communications or interactions with phantam.xyz and advise users against engaging with this domain to mitigate potential risks associated with brand impersonation.