aphantomwallet[.]framer[.]ai

The domain aphantomwallet.framer.ai is flagged for brand impersonation of the Phantom cryptocurrency wallet. Infrastructure analysis shows the site was created on January 06, 2018 and is hosted on Amazon's AS16509 network, resolving to IP address 35.71.142.77 located in the United States. The SSL certificate is issued by Let’s Encrypt (E8) and the site employs Framer Sites, React, HSTS, and HTTP/3, indicating a modern web stack despite its limited content. The page title returned from the server is "Site Not Found | Framer" and the HTTP response code is 404, suggesting the original malicious content has been removed or the domain is currently offline.

Registration data lists CSC Corporate Domains, Inc. as the registrar and the domain uses four AWS nameservers (ns-114.awsdns-14.com, ns-1198.awsdns-21.org, ns-1902.awsdns-45.co.uk, ns-635.awsdns). Security telemetry shows the domain appears on one blocklist and has been blocked by PhishDestroy. VirusTotal scans recorded six detections out of ninety‑five vendors, and Google Safe Browsing classifies the site under social engineering, reinforcing the malicious intent. The listed scam type is a crypto scam, and the domain explicitly impersonates the Phantom brand.

Uncertainty remains regarding the current payload or phishing page, as the live site returns a 404 error and no additional content is observable. Defenders should continue to block the domain at perimeter and DNS layers, monitor for any reactivation of the site, and add the domain to internal watchlists. Additional investigation of historic snapshots may reveal the original malicious landing page, and any related indicators of compromise should be correlated with existing threat intel for Phantom‑related campaigns.