phantomrbrookta[.]store

The domain phantomrbrookta.store is a cryptocurrency phishing site engaged in brand impersonation targeting Phantom, a well-known wallet provider. It poses an elevated risk by attempting to deceive users into disclosing sensitive information or transferring funds under false pretenses. As of the latest verification, phantomrbrookta.store has been taken offline, but prior activity indicates it was designed to mimic Phantom’s legitimate services to facilitate scams.

Technical indicators confirm the domain’s malicious intent. Seven of 95 VirusTotal security vendors flagged phantomrbrookta.store, including ChainPatrol, alphaMountain.ai, and Certego. It appears on one security blocklist (PhishDestroy) and was registered through Beget LLC on November 17, 2025. The domain resolved to IP address 87.236.16.164, hosted in Russia under AS198610 Beget LLC, with an SSL certificate issued by Google Trust Services / WE1. The observed page title, 'The new site has been successfully created and is ready to work,' suggests minimal content deployment, though technologies detected include WordPress, MySQL, PHP, and Cloudflare. Gridinsoft assigned a trust score of 0/100, reinforcing its classification as a scam.

Users who interacted with phantomrbrookta.store should immediately revoke any token approvals granted to unknown contracts and transfer remaining funds to a new wallet. If credentials were entered, change passwords for all associated accounts and enable two-factor authentication. Report the domain to Phantom’s official support channels and submit it to platforms like Google Safe Browsing, PhishTank, or the Anti-Phishing Working Group to aid in broader mitigation efforts.