phantomhromeextension[.]created[.]app

The domain phantomhromeextension.created.app was registered on July 12, 2023 through Tucows Domains Inc. and is delegated to Vercel DNS (ns1.vercel-dns.com, ns2.vercel-dns.com). DNS resolution points to the IP address 216.150.16.129, which belongs to Amazon.com, Inc. (AS16509) and is geolocated in the United States. An active TLS certificate issued by Let’s Encrypt (R13) secures the site, and HTTP requests return a 404 status code. The sole page title that can be retrieved – “Phantom® Chrome® Extension® | Getting started with Phantom®” – directly references the Phantom brand, indicating a brand‑impersonation attempt.

Infrastructure analysis shows the site runs on the Vercel platform and presents an HSTS header, suggesting the operators aimed to enforce HTTPS for any future content. The domain appears on a single public security blocklist and is explicitly listed as blocked by PhishDestroy. VirusTotal scans have flagged the domain in 11 of 95 security‑vendor engines, providing independent confirmation of malicious intent.

No additional content or functional pages have been observed, and the current offline status may be temporary. Defenders should add the domain to internal block and URL‑filter lists, monitor the associated IP range for re‑use, and consider filing a takedown request with the registrar. Ongoing brand‑monitoring is advised to detect any re‑appearance of phishing pages that mimic Phantom’s Chrome extension.