ioi-phomts-walet[.]pages[.]dev

The domain ioi-phomts-walet.pages.dev was registered on April 01, 2026 via Cloudflare, Inc. and resolves to the Cloudflare IP address 188.114.97.3, which is geolocated to Canada. The authoritative nameservers are jill.ns.cloudflare.com and peyton.ns.cloudflare.com. TLS termination is provided by Google Trust Services under the WE1 certificate, and the site enforces HSTS and HTTP/3, returning HTTP 200 on request. The page title "Phantom_@Wallet — Presentation with Exodus Web3 Wallet | Secure Your Crypto" explicitly references the Phantom brand, confirming a brand‑impersonation campaign aimed at crypto users. Infrastructure analysis shows a zero‑score from Gridinsoft (0/100) and a single detection on VirusTotal (1 of 94 vendors flagged the domain). The domain appears on one public blocklist, PhishDestroy, indicating that at least one security community has identified it as malicious. Risk is assessed as high and the status remains active. Defenders should immediately block the domain at network perimeter and DNS layers, monitor for related traffic to the associated Cloudflare IP, and enforce endpoint protections that can detect brand‑impersonation attempts. Continuous threat‑intel feeds should be consulted for any additional indicators, and users should be warned not to interact with any wallet‑related content hosted on this domain.