en-phanttomwals[.]pages[.]dev

The domain en-phanttomwals.pages.dev is identified as a generic phishing site, posing an elevated risk to users. It does not impersonate any specific brand nor does it employ a drainer kit. The domain is currently offline, indicating that it is not safe for users to visit or interact with.

Technical analysis of en-phanttomwals.pages.dev reveals that 11 out of 95 vendors on VirusTotal have flagged it as malicious, including ADMINUSLabs, ChainPatrol, and alphaMountain.ai. The domain was registered through Cloudflare, Inc. on September 30, 2025, and resolves to the IP address 172.66.47.18 located in the United States. It appears on one security blocklist, specifically PhishDestroy. The SSL certificate was issued by Google Trust Services / WE1, and the site displays a page title 'Suspected phishing site | Cloudflare'. The domain's HTTP status is 403, indicating restricted access.

Users who suspect they may have interacted with en-phanttomwals.pages.dev should take immediate safety measures. As this site is associated with credential phishing, users are advised to change their passwords for any accounts that may have been compromised and enable two-factor authentication where possible. Monitoring accounts for fraudulent activity is also recommended. To report any suspicious activity or phishing attempts related to this domain, users can contact relevant authorities or security services.