phantom-wallet-e-us[.]created[.]app

The domain phantom-wallet-e-us.created.app was registered through Tucows Domains Inc. on 12 July 2023 and resolves to the Amazon‑owned address 216.150.1.1 (AS16509, United States). Infrastructure analysis shows the site was hosted on Vercel, indicated by the use of Vercel DNS nameservers (ns1.vercel-dns.com, ns2.vercel-dns.com) and the presence of HSTS headers. A Let's Encrypt certificate (R13) was issued for the host, confirming TLS encryption was in place at the time of observation. HTTP probing returned a 404 status code, and the page title reported by scanners was “Homepage”, providing no further content clues.

The domain was flagged by the PhishDestroy blocklist and appears on one additional security blocklist, confirming prior detection as malicious. VirusTotal scans recorded 13 detections out of 95 participating vendors, reinforcing the malicious classification. The site was identified as a crypto‑related scam that impersonates the Phantom wallet brand, consistent with the “brand impersonation” and “crypto scam” labels in the intelligence feed. As of 23 July 2026 the domain is listed as offline, suggesting the operators have taken the site down or the hosting provider has removed it.

However, the underlying infrastructure (Vercel hosting, Amazon IP space) remains common among active threat actors, and the registration details are still valid. Defenders should continue to block the domain at perimeter filters, add the associated IP address to deny lists, and monitor the Vercel name servers for newly registered sub‑domains that may reuse the same pattern. Threat‑intel teams should correlate any future sightings of similar “phantom-wallet-*” subdomains with this seed to detect possible re‑use of the same toolkit. Because the site has already been removed, incident response focus should shift to detecting credential‑phishing or wallet‑drain attempts that may have originated while the site was live.