phantext[.]info

Analysis of phantext.info indicates the domain was created on 23 November 2025 and is currently taken offline. The site resolves to IP address 162.241.85.150, which is announced by AS46606 Unified Layer and geolocated to the United States. DNS resolution is handled by ns1.suspended-domain.com and ns2.suspended-domain.com, both of which are typical of domains that have been suspended or are in a transient state. No SSL certificate is presented for the domain, meaning HTTPS connections are not available and any traffic would be unencrypted.

The registrar listed is PDR Ltd. d/b/a PublicDomainRegistry.com, a known bulk registration service. The page title observed during the brief crawl was "My Blog - My WordPress Blog," which does not reference the targeted brand and suggests a generic WordPress template was used. The domain is classified as a brand impersonation targeting the brand "phantom," and the threat type is recorded as brand impersonation. Reputation metrics are extremely poor: Gridinsoft assigns a trust score of 0 out of 100, and the domain appears on one security blocklist.

VirusTotal scans show eight of ninety‑five security vendors flag the domain, reinforcing the malicious assessment. PhishDestroy has also blocked the domain, confirming that it was identified as part of a phishing campaign. Defenders should continue to block traffic to phantext.info at the network perimeter, monitor DNS queries for the associated IP and nameservers, and update URL filtering rules to include the domain and its host IP. Since the site is offline, any active credential harvesting is likely paused, but the infrastructure could be reused for future campaigns; therefore, threat‑intelligence feeds should retain the indicator set and correlate it with any new activity tied to the same IP range or registrar.