phantomwalletextensiondownload[.]blogspot[.]in

Analysis indicates that the domain phantomwalletextensiondownload.blogspot.in is actively impersonating Phantom, a cryptocurrency wallet service, as of July 12, 2026. The domain resolves to IP 142.250.195.129, hosted under AS15169 (Google LLC) in the United States. Infrastructure analysis reveals the domain was registered on June 24, 2020, through MarkMonitor, Inc., and is currently served via Google nameservers (ns1.google.com to ns4.google.com). The SSL certificate is issued by Google Trust Services (WE2), and the site returns an HTTP 302 redirect status, suggesting dynamic content handling. The page title explicitly states 'Phantom wallet extension download,' aligning with the reported scam type of cryptocurrency fraud. Detection data shows the domain is flagged by 11 of 93 security vendors on VirusTotal and appears on one security blocklist, specifically PhishDestroy. Technologies detected include Blogger, Java, Python, OpenGSE, Clipboard.js, and HTTP/3, which are consistent with a hosted blogging platform but do not rule out malicious intent. Defenders should treat this domain as high-risk due to its active impersonation of a cryptocurrency brand and confirmed presence on security blocklists. The use of a legitimate hosting provider and SSL certificate may reduce user suspicion, increasing the likelihood of successful phishing attempts. No evidence currently suggests compromise of legitimate infrastructure, but monitoring for further redirects or payload delivery is recommended. The exact content of the site has not been analyzed, so additional malicious functionality cannot be ruled out.