phamtom[.]us

This domain, phamtom.us, poses a high risk of brand impersonation, specifically targeting Google. The site is designed to trick users into believing they are interacting with a legitimate Google service, such as signing into their Google Accounts. If accessed, users may be prompted to enter sensitive information, including usernames, passwords, and possibly other personal data, which can be stolen by the attackers.

Analysis indicates that phamtom.us is a high-risk domain, with 20 out of 95 security vendors on VirusTotal flagging it as malicious. The domain was created on February 21, 2026, and is registered through Tucows Domains Inc. The site was hosted on an IP address (23.227.38.67) located in California, using Cloudflare, Inc. as the autonomous system (AS13335). The SSL certificate used on the site is issued by Google Trust Services, which can make the site appear more legitimate to unsuspecting users. Despite these efforts, the domain is currently offline and appears on three security blocklists, including PhishDestroy, MetaMask, and SEAL.

If an individual has visited phamtom.us, they should immediately check their Google account for any unauthorized activity. It is recommended to change the password and enable two-factor authentication (2FA) if it is not already active. Users should also monitor their financial accounts and credit reports for any signs of fraud. Reporting the incident to Google's security team and to the relevant authorities can help mitigate potential damage and alert others to the threat. Regularly updating security software and being cautious when clicking on links or entering personal information online can prevent future incidents.