ph-antom-wallet[.]pages[.]dev

The domain ph-antom-wallet.pages.dev was registered on February 21, 2026 through Cloudflare, Inc. and is served from the Cloudflare network (ASN13335) with the public address 172.66.44.187, located in the United States. DNS resolution uses the authoritative Cloudflare nameservers millie.ns.cloudflare.com and noah.ns.cloudflare.com. The site presents a TLS certificate issued by Google Trust Services under the WE1 root, confirming that HTTPS is correctly configured. HTTP responses return a 403 status code, and the server advertises HSTS and HTTP/3, indicating modern security features typical of Cloudflare‑protected sites. The page title observed in the HTTP response is "Connecting the Phantom Wallet to Your Project - DEV Community®", which suggests an attempt to lure users interested in cryptocurrency wallets.

The threat classification is brand impersonation targeting Discord, and the overall scam type is identified as a crypto scam. Reputation data shows a Gridinsoft trust score of 0 out of 100, reflecting extreme distrust. VirusTotal analysis recorded 2 detections out of 93 security vendors, and the domain appears on a single blocklist, specifically PhishDestroy. Google Safe Browsing flags the site for social engineering, reinforcing the phishing nature of the content.

The combination of a low trust score, multiple vendor detections, blocklist inclusion, and Safe Browsing flag provides strong evidence that the domain is being used for malicious impersonation. Current operational status is offline, but historical activity suggests it was actively serving malicious content before takedown. Defenders should continue to block the IP address 172.66.44.187, add the domain to local and network‑wide blocklists, and monitor for any re‑registration attempts that reuse similar naming patterns or the same Cloudflare infrastructure.