phantom-v3[.]at

The domain phantom-v3.at was observed hosting a page whose title reads “Phantom – Secure Multi‑Chain Crypto & NFT Wallet”. The title directly references the legitimate Phantom wallet brand, indicating an attempt to impersonate that service. The site is classified as a wallet/seed phishing operation, targeting users who may enter recovery phrases. Technical analysis shows the domain resolves to the IPv4 address 178.16.54.12, which is registered to AS202412 owned by Omegatech LTD and geolocated to the Netherlands. No TLS certificate is presented; HTTP connections are served without encryption, which is typical for malicious drop‑off sites and limits confidence in transport security.

Nameserver delegation points to ns1.ddos-guard.net and ns2.ddos-guard.net, both commonly used by infrastructure that provides DDoS mitigation for transient malicious hosts. VirusTotal reports that 13 out of 95 scanned engines flagged the domain, providing independent confirmation of malicious intent. The domain appears on the PhishDestroy blocklist, and the blocklist entry is the only public listing currently known. The site has been taken offline at the time of reporting, and no HTTP response body was captured.

No SSL/TLS, safe‑browsing, or Open Threat Exchange records were found in the supplied data, leaving those vectors unverified. Defenders should block resolution of phantom‑v3.at at DNS level, monitor outbound connections to 178.16.54.12, and add the associated IP and AS to intrusion‑detection signatures. Users of the Phantom wallet should be warned that any unsolicited request for seed phrases originating from this domain is malicious, and should be instructed to verify URLs against the official Phantom site. Ongoing telemetry should be collected to detect any re‑hosting attempts that may use the same infrastructure or nameservers.