get-phantomwalet-on[.]framer[.]media

The domain get-phantomwalet-on.framer.media is currently offline but exhibits several indicators of a crypto‑related brand impersonation campaign targeting users of the Phantom Solana wallet. The site was registered on November 19 2021 through CSC Corporate Domains, Inc. and is hosted on Amazon Web Services, resolving to 52.223.52.2 (AS16509, United States). Authoritative name servers ns‑1854.awsdns‑39.co.uk, ns‑97.awsdns‑12.com, ns‑535.awsdns‑02.net and ns‑1267.awsdns‑… confirm the AWS DNS infrastructure. An SSL certificate issued by Let’s Encrypt (identifier E7) protects the domain, and traffic is served over HTTP/3 with HSTS enabled.

Fingerprinting tools identified the site as built with Framer Sites and React. The only publicly visible content returned a 404 HTTP status, but the page title captured by crawlers reads “Phantom Wallet: A Complete Guide to the Popular Solana Crypto Wallet,” directly referencing the Phantom brand. VirusTotal scans show that six of ninety‑five security vendors flagged the domain, reinforcing the suspicion of malicious intent. The domain appears on one external security blocklist and is already blocked by the PhishDestroy feed, indicating that defensive communities have taken action.

Because the site is offline, active payloads cannot be confirmed, and the exact phishing kit or credential‑harvesting mechanism remains unknown. However, the combination of brand‑specific phrasing, the crypto‑scam classification, and the presence of a legitimate‑looking SSL certificate suggests a high likelihood of credential‑stealing or token‑draining activity aimed at Phantom wallet users. Defenders should add get‑phantomwalet‑on.framer.media to URL filtering and DNS block lists, monitor the associated AWS IP range for similar Framer‑hosted subdomains, and enforce strict outbound controls for connections to unknown wallet‑related domains.