io-phntom-wallet[.]pages[.]dev

Analysis on 24 July 2026 indicates that the domain io-phntom-wallet.pages.dev is actively used to lure victims into a wallet/seed phishing campaign. The page title advertised as “Phantom Wallet | Download Extension | Crypto & NFT Wallet” suggests an attempt to impersonate the legitimate Phantom cryptocurrency wallet extension. Google Safe Browsing categorises the site as social engineering, and 11 of 95 VirusTotal scanners flagged it as malicious. The domain was registered on 21 February 2026 through Cloudflare, Inc., and resolves to the Cloudflare‑owned address 188.114.97.3 located in the United States under ASN 13335.

DNS is served by arushi.ns.cloudflare.com and denver.ns.cloudflare.com. The site presents HSTS, HTTP/3, and serves a certificate issued by Google Trust Services/WE1, confirming the use of legitimate TLS infrastructure. Despite the valid certificate, Gridinsoft assigns a trust score of 0 / 100, reinforcing its malicious intent. HTTP requests return a 403 status, and the domain is listed on at least one security blocklist and is blocked by PhishDestroy.

The current operational status is offline, indicating the operators have taken the site down, but the infrastructure remains observable. Defenders should immediately add the domain and its resolving IP to deny‑list rules, enforce URL filtering for any pages containing “Phantom Wallet”, and monitor for new subdomains under the *.pages.dev namespace that reuse the same Cloudflare nameservers. Given the social engineering classification and the wallet‑seed phishing vector, user education about unsolicited requests for crypto seed phrases and the authenticity of browser‑extension downloads is critical. Continuous intelligence gathering on related Cloudflare‑hosted assets is advised to pre‑empt re‑deployment of the campaign.