phntm-navwallet[.]pages[.]dev

The domain phntm-navwallet.pages.dev is assessed as a high-risk brand impersonation threat, specifically targeting Binance. This type of attack aims to deceive users into believing they are interacting with a legitimate Binance service, potentially leading to the theft of sensitive information such as login credentials and financial data.

Analysis indicates that the domain phntm-navwallet.pages.dev is flagged by 12 out of 95 security vendors on VirusTotal, suggesting a moderate level of detection. The domain was registered through Cloudflare, Inc., and resolves to the IP address 172.66.44.133, which is located in the United States and is part of the AS13335 Cloudflare, Inc. network. The domain was created on October 27, 2025, and is currently offline. The site's SSL certificate is issued by Google Trust Services, and it has been labeled as a phishing site by Google Safe Browsing. Additionally, it appears on one known security blocklist, further confirming its malicious nature.

To mitigate the risks associated with this brand impersonation scam, users should avoid clicking on any links or entering personal information on the site. Security teams are advised to implement DNS-based blocking or web filtering solutions to prevent access to the domain. Organizations should also educate their employees and users about the signs of brand impersonation and the importance of verifying the authenticity of websites before interacting with them. Regularly updating security software and maintaining a vigilant approach to online security can help prevent such attacks from succeeding.