bluko[.]top

The domain bluko.top is a phishing site engaged in brand impersonation targeting users of the Phantom cryptocurrency wallet. It was designed to deceive victims into believing they were interacting with the legitimate Phantom platform, potentially leading to credential theft or unauthorized transactions. As of the latest verification, bluko.top has been taken offline, though its prior activity remains a confirmed scam.

Technical analysis of bluko.top reveals limited but notable detection: 3 of 95 security vendors on VirusTotal flagged the domain, including G-Data, Gridinsoft, and SOCRadar, while Gridinsoft assigned it a trust score of 0/100. The domain was registered on August 19, 2025, through NameSilo, LLC, and resolved to the IP address 45.67.85.152, hosted by Kuroit Limited (AS203363) in the United Kingdom. It appeared on two security blocklists, PhishDestroy and ScamSniffer, and used nameservers ns1.dnsowl.com, ns2.dnsowl.com, and ns3.dnsowl.com. No SSL certificate was present, and the observed page title was 'VAN'.

Users who interacted with bluko.top should immediately revoke any token approvals granted to unknown contracts and transfer funds to a new, secure wallet. Enable two-factor authentication (2FA) on all cryptocurrency accounts and monitor for unauthorized transactions. Change passwords for any accounts accessed while the site was active. Report the domain to relevant platforms, including Phantom’s official support channels, and submit it to additional blocklists such as Google Safe Browsing or PhishTank to prevent further abuse.