same-clone-httpsphantom-com-0ov51pijrj2-latest[.]netlify[.]app

Analysis indicates the domain same-clone-httpsphantom-com-0ov51pijrj2-latest.netlify.app was an active brand impersonation threat targeting Phantom, a cryptocurrency wallet service. As of July 25, 2026, the domain has been taken offline and returns an HTTP 404 status. The page title, 'Phantom: The crypto wallet for everyone,' directly matches the branding of the legitimate Phantom service, confirming the intent to deceive users into believing the site was an official wallet portal. The domain was hosted on Netlify infrastructure and resolved to IP address 18.208.88.157, located in the United States under Amazon.com, Inc. (AS14618).

SSL certification was provided by DigiCert Inc, using a DigiCert Global G2 TLS RSA SHA256 2020 CA1 certificate, which does not inherently indicate malicious activity but is commonly observed in phishing infrastructure to lend a false sense of legitimacy. The domain appeared on one security blocklist, specifically PhishDestroy, and was flagged by 15 of 95 security vendors on VirusTotal, suggesting moderate detection coverage at the time of analysis. No nameserver data or additional hosting details were available. The scam type was classified as a crypto scam, though the exact mechanics—such as whether it functioned as a credential harvester, fake wallet distributor, or crypto drainer—remain unconfirmed due to the domain's current offline status.

Defenders should treat this domain as part of a broader pattern of Phantom impersonation campaigns, particularly those leveraging cloud hosting platforms like Netlify to rapidly deploy and rotate phishing pages. Organizations are advised to block the domain at the network level, monitor for related infrastructure using the unique seed '9c0ede,' and alert users to the prevalence of crypto wallet impersonation threats. Further investigation into the SSL certificate chain and hosting provider logs may reveal additional linked domains or attacker infrastructure.