phantom-wallet[.]blogspot[.]ro

Analysis of phantom-wallet.blogspot.ro indicates a confirmed phishing domain targeting users of the Phantom crypto wallet. The domain, hosted on Blogger infrastructure, presents a page title explicitly matching the brand: 'Phantom Wallet - A friendly Crypto Wallet.' Despite the domain's creation date of May 14, 2006, which predates the emergence of the Phantom brand, the page title and scam classification as a 'Crypto Scam' strongly suggest malicious repurposing of an older, legitimate domain. The domain resolves to IP 172.217.165.129, part of AS15169 (Google LLC), and employs nameservers ns1.google.com through ns4.google.com, consistent with Google-hosted properties. SSL certification is provided by Google Trust Services (WE2), and detected technologies include Blogger, Java, Python, OpenGSE, and HTTP/3.

Detection data reveals the domain is flagged by 13 of 93 security vendors on VirusTotal and appears on one security blocklist, specifically PhishDestroy. The HTTP status code 302 indicates a temporary redirect, which may be used to evade detection or dynamically serve malicious content. While the domain's age and hosting on a reputable platform could initially appear benign, the combination of brand impersonation, explicit crypto scam classification, and detection by multiple security vendors confirms malicious intent. Defenders should treat this domain as high-risk and prioritize blocking it at the DNS or network level.

The use of Google's infrastructure suggests potential abuse of legitimate services, and the 302 redirect may obscure further malicious activity. No evidence of takedown or suspension is present as of July 23, 2026, and the domain remains active. Further investigation should focus on identifying associated wallets, redirect chains, or payload delivery mechanisms.