hosteramuser[.]xyz

The domain hosteramuser.xyz was registered on March 22, 2026 through OwnRegistrar, Inc. and is currently offline. DNS resolution points to the IP address 146.103.40.188, which is hosted by Regxa Company for Information Technology Ltd in Germany and serves content over an Nginx web server on an Ubuntu operating system. The site presents a Let's Encrypt TLS certificate, indicating that HTTPS was active at the time of observation. The authoritative nameservers listed are 795.dns1.managedns.org, 795.dns2.managedns.org, and 795.dns3.managedns.org.

The page title extracted from the site is "Вхід - Phantom Wallet," confirming that the content was aimed at the Phantom brand and falls under the crypto‑scam category. VirusTotal analysis recorded four positive detections out of ninety‑four scanned security vendors, and the domain appears on three public blocklists. Additional blocklist entries from PhishDestroy, MetaMask, and SEAL further corroborate the malicious classification. The observable evidence aligns with a brand‑impersonation campaign that attempts to harvest credentials or otherwise deceive users of the Phantom wallet service.

While the site is no longer reachable, the infrastructure components—including the IP host, SSL certificate, and server stack—remain reusable for future operations. Defenders should continue to block the host IP and associated nameservers, update phishing detection rules with the observed page title and TLS fingerprint, and monitor the registrar for any new registrations that reuse the same infrastructure. Continuous feed of blocklist updates and threat‑intel sharing will help mitigate residual risk from this campaign.