p-hantomwalletextensionn[.]pages[.]dev

PhishDestroy identifies p-hantomwalletextensionn.pages.dev as a brand impersonation domain targeting Phantom users. The domain uses a multi-character typo-squatting pattern (p-hantom vs. phantom) to mimic Phantom's official extension branding. This site is likely a cryptocurrency wallet drainer kit designed to deceive users into connecting their wallets and approving malicious token approvals or transfers. The domain leverages Cloudflare Pages for hosting, which provides SSL termination via Google Trust Services certificates, adding a veneer of legitimacy to the fraudulent site.

This domain resolves to IP 188.114.97.3 and remains undetected by VirusTotal with a score of 2/95 detections as of last assessment. It is registered through Cloudflare, Inc., and the exact creation date is not reflected in available data. Google Safe Browsing (GSB) has not yet flagged the domain, and no current blocklist entries were detected. The absence of detections suggests a newly deployed campaign that has not yet triggered automated security responses.

The domain is currently active and under investigation by threat intelligence teams. Users are advised not to interact with p-hantomwalletextensionn.pages.dev or any similarly named Phantom-related domains. Blocking the domain at the network level and reporting it to Phantom and relevant security vendors is recommended. Although current risk is elevated due to low detection, the campaign may expand or evolve rapidly. Remaining risk includes potential wallet compromise and fund theft, particularly targeting users searching for Phantom wallet extensions. Immediate defensive actions are strongly advised.