v1-phantom[.]at

The domain v1-phantom.at was observed hosting a wallet‑seed phishing page that impersonates the Phantom crypto wallet, as indicated by the page title "Phantom – Secure Multi‑Chain Crypto & NFT Wallet" and the explicit brand target of Phantom. Infrastructure analysis shows the domain resolves to the IPv4 address 178.16.54.12, which belongs to AS202412 operated by Omegatech LTD in the Netherlands. The authoritative name servers are ns1.ddos-guard.net and ns2.ddos-guard.net, a pair commonly associated with fast‑flux or DDoS‑mitigation services. No TLS certificate was presented, meaning the site served traffic over plain HTTP, a characteristic that reduces credibility and may facilitate interception.

The domain appears on a single security blocklist and has been actively blocked by the PhishDestroy service, confirming that at least one anti‑phishing provider has taken mitigation action. VirusTotal scans returned 14 positive detections out of 95 submitted security vendors, reinforcing the malicious classification. Gridinsoft assigned a trust score of 0 / 100, indicating the lowest possible confidence in the site’s safety. The site’s current status is offline, which limits real‑time verification, but the accumulated evidence supports a high confidence that the domain was used for credential or seed phrase harvesting.

Uncertainties remain regarding the exact phishing kit employed and any additional command‑and‑control infrastructure, as those details were not disclosed in the available intelligence. Defenders should continue to block the domain at DNS and network layers, monitor the associated IP range for related activity, and update endpoint protection signatures to reflect the observed detection patterns. Organizations that use Phantom wallets should alert users to the possibility of brand‑spoofing attempts and advise verification of official URLs before entering any sensitive information.