us-phantom[.]at

Analysis of the domain us-phantom.at, observed on July 23, 2026, confirms that it operates as a crypto‑focused impersonation site targeting the Phantom brand. The site is currently taken offline, but historical data indicate it was hosted on the IP address 178.16.54.12, which resolves to the Netherlands (AS202412 Omegatech LTD). No SSL certificate was presented for the domain, leaving HTTPS traffic unencrypted and exposing visitors to potential man‑in‑the‑middle interception. The domain was listed on a single security blocklist and is explicitly blocked by the PhishDestroy service, evidencing active mitigation by at least one commercial anti‑phishing provider.

The authoritative nameservers ns1.ddos-guard.net and ns2.ddos-guard.net suggest the use of a DDoS‑mitigation service, a common tactic for short‑lived malicious infrastructure. The page title returned by the server, "Phantom – Secure Multi‑Chain Crypto & NFT Wallet," aligns with the declared scam type of a crypto scam and the impersonated brand, reinforcing the intent to deceive users seeking Phantom wallet services. VirusTotal scanning recorded 14 detections out of 95 security vendors, indicating that a notable minority of analysis engines flagged the domain as malicious. Gridinsoft assigned a trust score of 0 out of 100, further corroborating its malicious reputation.

While the precise content of the landing page has not been captured, the available metadata – brand name, scam classification, page title, and detection rates – provide sufficient confidence to label the domain as a confirmed crypto impersonation threat. Defenders should continue to block the domain at network perimeters, update URL filtering lists, and monitor the associated IP address for any re‑use. Threat intelligence teams are advised to correlate this indicator with any recent phishing campaigns targeting Phantom users and to share the indicator with industry ISACs to expedite broader mitigation.