phantom-walleat-cdn-aask[.]framer[.]media

Analysis of the domain phantom-walleat-cdn-aask.framer.media indicates an elevated-risk brand impersonation campaign targeting Phantom, a cryptocurrency wallet provider. The domain, registered through CSC Corporate Domains, Inc. on November 19, 2021, resolves to the IP address 52.223.52.2, hosted on Amazon Web Services (AS16509) in the United States. Infrastructure analysis reveals the use of AWS nameservers (ns-1267.awsdns-30.org, ns-1854.awsdns-39.co.uk, ns-535.awsdns-02.net, and ns-97.awsdns) and a Let's Encrypt SSL certificate (identifier E7), suggesting a technically configured operation rather than an opportunistic scam. The page title, 'Phantom Wallet Mobile App – Crypto & NFTs on the Go,' explicitly aligns with Phantom's branding, and the domain has been classified as a crypto scam.

Detection data from July 23, 2026, shows the domain appears on one security blocklist (PhishDestroy) and is flagged by 12 of 93 security vendors on VirusTotal, confirming its malicious classification. Technologies detected include Framer Sites, React, HSTS, and HTTP/3, which are consistent with modern web development practices but do not exclude malicious intent. As of the report date, the domain returns an HTTP 404 status, indicating it is offline or no longer serving content.

While the exact content of the site was not analyzed, the available evidence—including the page title, brand impersonation classification, and detection counts—supports the conclusion that this domain was used for fraudulent purposes. Defenders are advised to treat this domain as malicious and block it at the network level. Further monitoring of related infrastructure, particularly domains registered through CSC Corporate Domains or hosted on AWS with similar naming conventions, is recommended to identify potential follow-up campaigns.