phantom-wallett[.]blogspot[.]gr

This domain is assessed as HIGH risk and confirmed as a brand impersonation phishing site targeting Phantom wallet users. Analysis indicates a credential harvesting objective through counterfeit wallet interface presentation designed to deceive users into exposing sensitive authentication data. The risk level is classified as high due to confirmed phishing behavior and active security detections.

Infrastructure and intelligence signals provide multiple corroborating indicators. The domain phantom-wallett.blogspot.gr was created on February 21, 2026 and is currently taken offline. VirusTotal reports 18/95 security vendors flagging the domain as malicious. It resolves to IP 142.251.141.65 located in the United States under AS15169 Google LLC. The SSL certificate is issued by Google Trust Services / WE2. Google Safe Browsing explicitly flags the domain as phishing. The registrar is Google LLC. The page title identified is "Phantom Wallet - A friendly Crypto Wallet". Additional containment includes blocking by PhishDestroy, MetaMask, and SEAL, with appearance on 3 security blocklists. The domain impersonates the Phantom brand.

Mitigation should include immediate domain blocking at DNS and web gateway layers, addition to enterprise threat intelligence feeds, and user awareness controls for wallet-related phishing. Any traffic to this domain should be treated as hostile, with credential entry attempts considered compromised. Incident response teams should correlate access logs for potential exposure and enforce MFA and wallet security resets where applicable. Continuous monitoring is recommended given the infrastructure’s use of reputable hosting signals to bypass trust-based filtering.