phantom-wallet[.]blogspot[.]fi

This domain, phantom-wallet.blogspot.fi, poses as a legitimate Phantom crypto wallet interface to deceive users into entering sensitive credentials, seed phrases, or private keys. The site mimics the branding and design of the official Phantom wallet, presenting itself as a "friendly Crypto Wallet" to exploit trust in the targeted brand. Such impersonation sites are commonly used to drain cryptocurrency assets once victims input their authentication details or connect their wallets to the fraudulent platform. Analysis indicates the domain was registered on March 06, 2011, through MarkMonitor, Inc., though the phishing content appears to have been hosted more recently. It is flagged by 12 out of 95 security vendors on VirusTotal, including entries on three security blocklists. The domain resolves to an IPv6 address (2a00:1450:4001:81d::2001) associated with Google LLC infrastructure in Germany, and uses an SSL certificate issued by Google Trust Services. Despite its long registration history, the domain’s current use aligns with malicious impersonation activity targeting cryptocurrency users. If you visited phantom-wallet.blogspot.fi or entered any information on the site, immediately disconnect any connected wallets and cease all interactions. Revoke any permissions granted to unknown or suspicious applications via your wallet settings. Transfer remaining assets to a new, secure wallet using a trusted device. Monitor linked accounts for unauthorized transactions and report the incident to relevant security teams or blocklist providers. Do not reuse passwords or seed phrases exposed to this domain, as they may be compromised.