ph-omt-swalet[.]pages[.]dev

This domain, ph-omt-swalet.pages.dev, is identified as an active brand impersonation threat targeting Phantom, a widely used cryptocurrency wallet. The page presents itself under the title 'Phantom_@Wallet — Presentation,' mimicking legitimate wallet interfaces to deceive users into disclosing sensitive credentials or authorizing malicious transactions. Analysis indicates the domain is designed to facilitate cryptocurrency theft, likely through a crypto drainer mechanism, though no specific drainer kit signature has been confirmed at this stage. Infrastructure analysis reveals the domain resolves to the IP address 172.66.44.159, hosted by Cloudflare, Inc. in Canada. The domain was registered through Cloudflare, Inc. on March 25, 2026, and is secured with an SSL certificate issued by Google Trust Services (WE1). Detection metrics show zero detections out of 95 engines on VirusTotal, suggesting the threat is either newly deployed or employs evasion techniques. Google Safe Browsing has flagged the domain as phishing, and it appears on one security blocklist, specifically PhishDestroy. The domain remains active as of this analysis, posing a high risk to users who may inadvertently interact with it. No takedown or sinkholing actions have been observed, and the infrastructure remains operational. Users are advised to verify domain authenticity before entering credentials or connecting wallets, particularly when prompted by unsolicited links. Organizations are recommended to update blocklists with this domain and monitor for related indicators of compromise, including the associated IP address and SSL certificate issuer.