phantom-zoin[.]pages[.]dev

Analysis of phantom-zoin.pages.dev indicates that the domain is being used to impersonate the brand Phantom in a crypto‑focused scam. The site presents the page title "Suspected phishing site | Cloudflare," which is a default Cloudflare warning page rather than a custom landing page. The domain was registered on July 25, 2023 through Cloudflare, Inc. and resolves to the IPv6 address 2606:4700:310c::ac42:2ef8, an address owned by AS13335 Cloudflare, Inc. located in the United States. The SSL certificate presented is issued by Google Trust Services under the WE1 identifier, confirming that TLS termination is performed at Cloudflare's edge.

HTTP requests return a 403 status code, and the site enforces HSTS while supporting HTTP/3, both typical of Cloudflare‑protected services. Reputation data shows that four of ninety‑five VirusTotal scanners flagged the domain, and Gridinsoft assigned a trust score of zero out of one hundred, indicating a high likelihood of malicious activity. The domain appears on a single security blocklist and has been actively blocked by the PhishDestroy mitigation service. Nameserver configuration points to cullen.ns.cloudflare.com and gloria.ns.cloudflare.com, consistent with the registrar information.

Current evidence confirms the domain’s association with a crypto scam targeting users of the Phantom brand, but no additional payload, redirect chain, or credential‑harvesting page has been captured. The exact phishing content and any associated command‑and‑control infrastructure remain unknown because the site is offline at the time of analysis. Defenders should continue to block the domain at network perimeter devices, update URL filtering rules, and monitor for any resurrected infrastructure that may reuse the same IP range or certificate. Continuous observation of Cloudflare‑hosted IP blocks and rapid sharing of the domain’s identifiers with threat‑intel platforms will aid in early detection of re‑deployment attempts.