phantom-payout[.]ru

This domain presents a high-risk crypto drainer threat, specifically targeting Phantom wallet users with a fake login page designed to steal cryptocurrency credentials and drain wallets. The site was identified as a Solana Drainer kit, a common tool used by scammers to harvest private keys and seed phrases. Although currently offline, the domain poses a significant risk to anyone who may have visited it while active, as the drainer could have been triggered automatically.

PhishDestroy's investigation reveals multiple technical red flags. The domain was registered on April 28, 2026, through TIMEWEB-RU, a Russian registrar often associated with malicious domains. It resolves to IP 178.72.132.158 and uses a Let's Encrypt SSL certificate (E7), which provides a false sense of security. VirusTotal flags it with 9 out of 95 security vendors marking it as malicious, and Google Safe Browsing lists it as phishing. The domain appears on three security blocklists, and its trust score is critically low. The page title was simply "Phantom," mimicking the legitimate wallet interface to deceive users.

To protect against such threats, users should always verify the authenticity of any crypto wallet site by checking the official domain from trusted sources. Never enter seed phrases or private keys on any website, especially those reached via unsolicited links or ads. Use a hardware wallet and enable two-factor authentication where possible. If you suspect you have interacted with this site, immediately revoke any token approvals and transfer funds to a new, secure wallet. Report any suspicious domains to PhishDestroy and security blocklists to help protect the community.