phantomwnallet[.]webflow[.]io

The domain phantomwnallet.webflow.io was observed delivering a crypto‑scam impersonating the Phantom wallet service. Registration records show the domain was created on 08 May 2013 and is listed under the MarkMonitor, Inc. registrar, a provider commonly associated with legitimate brand‑protection services. The authoritative name servers resolve to journey.ns.cloudflare.com and lamar.ns.cloudflare.com, indicating Cloudflare’s DNS infrastructure. DNS resolution points to the IPv4 address 104.18.36.248, which belongs to AS13335 Cloudflare, Inc. and is geolocated to the United States.

TLS termination is performed by a Google Trust Services certificate issued to the WE1 organization, confirming the use of a publicly trusted certificate chain. An HTTP request to the root URL returns a 404 status code, suggesting the site is no longer serving content, and the current status is reported as taken offline. VirusTotal analysis recorded 14 detections out of 95 scanned security vendors, and the domain appears on a single security blocklist where it has been annotated by PhishDestroy as a brand‑impersonation vector. The page title retrieved from the host reads “Phantom Wallet – Connect Your Wallet – Phantom”, directly referencing the targeted brand and aligning with the classified “Crypto Scam” category.

No additional payload or malicious file hashes have been disclosed, and the available evidence is limited to infrastructure and branding attributes. Defenders should continue to block the resolved IP address and the domain name at network perimeter solutions, update URL‑filtering policies to include this FQDN, and monitor for future registrations that reuse the same Cloudflare name‑server pair or similar page titles referencing Phantom. Given the presence of multiple vendor detections and the confirmed brand impersonation, the domain merits an elevated risk rating until the underlying infrastructure is fully mitigated.