phantom-track[.]com

Analysis of phantom-track.com shows a recently registered domain (created 27 Oct 2025) hosted on Google Cloud infrastructure (AS396982, IP 34.149.87.45, United States). The site presents a valid TLS certificate from Let’s Encrypt (R13) and responds with HTTP 200, indicating an operational web server. DNS records point to Wix‑provided nameservers (ns4.wixdns.net, ns5.wixdns.net) and a single MX entry directed at smtp.google.com, which is typical for domains using Google Workspace but does not imply legitimate email use. Technical fingerprinting detects Vercel services and the presence of HTTP Strict Transport Security (HSTS), both consistent with modern hosting stacks.

Content‑level evidence is limited to the page title “The Cozy Planet | Weighted Blankets,” which bears no obvious relation to the claimed brand target “Phantom,” suggesting the page may be a placeholder or lure. The domain is explicitly classified as a “Crypto Scam” and is listed as impersonating the brand Phantom. Reputation signals are overwhelmingly negative: Gridinsoft assigns a trust score of 0/100, the domain appears on at least one security blocklist, and PhishDestroy has already blocked it. VirusTotal analysis shows 14 of 95 scanning engines flag the domain, reinforcing the malicious assessment.

Given the convergence of a high‑risk brand impersonation, active hosting, valid TLS, and multiple independent detections, defenders should treat phantom‑track.com as a confirmed malicious actor. Recommended mitigation steps include adding the domain to outbound web‑filter blocklists, configuring email gateways to reject or quarantine any messages originating from its MX record, and updating intrusion detection signatures to flag HTTP requests to the IP 34.149.87.45. Continuous monitoring of any changes to DNS, SSL, or content is advised, as threat actors may later adjust the site to stage credential‑harvesting pages or cryptocurrency‑draining payloads.