phantomw[.]net

This domain is flagged as a brand impersonation threat designed to deceive users of the Phantom crypto and NFT wallet. The site presents itself as an official Phantom portal, offering fake extension downloads and login pages for Solana-based assets. Victims who interact with the site risk unauthorized access to their wallets, potential credential theft, or exposure to malicious payloads that could compromise their digital assets. The impersonation extends to visual and functional elements, including a near-identical page title, which increases the likelihood of user deception. Analysis indicates this domain was registered on May 21, 2025, through Paknic Private Limited, a registrar with a history of hosting fraudulent infrastructure. The domain lacks an SSL certificate, a red flag for user security, and resolves to an IP address (62.60.187.103) located in Russia under AS207713 (GLOBAL INTERNET SOLUTIONS LLC). Security vendors on VirusTotal flagged the domain at a ratio of 19 out of 95, and it appears on two security blocklists, including PhishDestroy and ScamSniffer. The absence of encryption and the domain's recent creation further corroborate its malicious intent. Users who visited phantomw.net or interacted with its content should immediately revoke any active sessions linked to Phantom or Solana wallets. Disconnect all connected dApps and review wallet permissions for unauthorized access. If credentials or recovery phrases were entered, transfer assets to a new wallet and monitor all associated accounts for suspicious activity. Report the domain to relevant security teams or blocklist providers to prevent further exploitation. Avoid re-engaging with the domain, as it may still host residual threats even if currently offline.