phantomse[.]vip

PhishDestroy identifies phantomse.vip as a high-risk brand impersonation threat specifically targeting the Phantom cryptocurrency wallet brand. This is not a generic phishing domain but a calculated impersonation designed to trick Phantom users into revealing sensitive credentials or private keys. The domain's sole purpose appears to be harvesting login information or seed phrases from unsuspecting victims.

Technical analysis reveals that phantomse.vip was created on February 21, 2026, and registered through Dynadot LLC. It resolves to IP address 203.168.129.149 and holds an SSL certificate issued to Internet Widgits Pty Ltd, a common placeholder that adds a veneer of legitimacy. VirusTotal data shows 17 out of 95 security vendors flagging this domain as malicious, and it appears on three security blocklists. Google Safe Browsing specifically flags it for phishing activity. The page title is simply "Phantom," further reinforcing the deceptive intent. The domain is currently offline, indicating active takedown efforts.

Users who may have interacted with phantomse.vip should immediately change their Phantom wallet passwords and enable two-factor authentication if available. Scan all devices with updated antivirus software and monitor for unauthorized transactions. Because brand impersonation targets specific credentials, affected users should also revoke any permissions granted to suspicious dApps and consider migrating funds to a new wallet. PhishDestroy recommends reporting any related phishing URLs to Google Safe Browsing and the Phantom support team to help prevent future attacks.