phantomwalletdownload[.]blogspot[.]sk

This domain, phantomwalletdownload.blogspot.sk, poses a direct threat to users by impersonating Phantom, a legitimate cryptocurrency wallet service. The site presents itself as an official download portal for the Phantom wallet, tricking visitors into entering sensitive credentials or downloading malicious software. Given the rising prevalence of crypto-related phishing attacks, this domain exploits user trust in the Phantom brand to facilitate unauthorized access to digital assets or personal information. Analysis indicates the domain is flagged by 10 out of 95 security vendors on VirusTotal, confirming its malicious nature. It appears on one security blocklist and resolves to the IP address 142.250.80.65, which is hosted by Google LLC (AS15169). The SSL certificate, issued by Google Trust Services, does not mitigate the risk, as phishing sites frequently use valid certificates to appear legitimate. The domain is registered through Google’s infrastructure, which aligns with its hosting on Blogspot, a common platform for low-cost phishing campaigns. Users who visited phantomwalletdownload.blogspot.sk should immediately revoke any credentials entered on the site and monitor their cryptocurrency wallets for unauthorized transactions. If any software was downloaded from the domain, the affected device should be scanned with updated security tools to detect and remove potential malware. Additionally, users should verify the authenticity of any wallet-related communications by accessing the official Phantom website directly, rather than following links from untrusted sources. Given the domain’s current offline status, it may reappear under a different name, so vigilance is advised.