phntom-io-wllet[.]pages[.]dev

The domain phntom-io-wllet.pages.dev is a confirmed phishing site engaged in brand impersonation targeting Phantom, a cryptocurrency wallet service. This site was designed to deceive users into believing it was the legitimate Phantom platform, likely to harvest login credentials or other sensitive information. As of the latest verification, phntom-io-wllet.pages.dev has been taken offline, but it previously posed an elevated risk due to its convincing impersonation of a trusted brand.

Technical indicators confirm the malicious nature of phntom-io-wllet.pages.dev. The domain was flagged by 2 of 95 security vendors on VirusTotal, including ADMINUSLabs and Fortinet, and appeared on 1 security blocklist (PhishDestroy). It was registered through Cloudflare, Inc. on October 28, 2025, and resolved to the IPv6 address 2a06:98c1:3120::3, hosted on Cloudflare's infrastructure (AS13335). The SSL certificate was issued by Google Trust Services (WE1), and the observed page title was 'Suspected phishing site | Cloudflare'. The domain employed technologies such as HSTS, Cloudflare, and HTTP/3, and returned an HTTP 403 status at the time of analysis.

Users who may have interacted with phntom-io-wllet.pages.dev should immediately change their Phantom wallet passwords and enable two-factor authentication if available. Monitor accounts for unauthorized transactions or signs of fraud, and consider revoking any token approvals granted during the suspected exposure period. Report the phishing domain to the impersonated brand (Phantom) and relevant authorities, such as the Anti-Phishing Working Group (APWG) or local cybercrime units, to aid in mitigation efforts.