phantom-security[.]icu

This domain, phantom-security.icu, was registered through NameCheap, Inc. on 12 November 2025 and is currently listed as taken offline. DNS resolution points to 104.21.58.96, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. The authoritative nameservers are candy.ns.cloudflare.com and gabriel.ns.cloudflare.com, both Cloudflare‑operated, indicating that the infrastructure is hosted behind a CDN service. No TLS certificate is presented for the host, so HTTPS connections would be unavailable or would fall back to HTTP. The only visible HTTP artifact is the page title “Just a moment…”, which provides no functional indication of the site’s purpose.

Gridinsoft assigns a trust score of 0 out of 100, the lowest possible rating, reflecting extreme suspicion. VirusTotal has recorded 12 detections out of 95 scanned scanners, confirming that multiple security vendors flag the domain as malicious. The domain appears on a single external blocklist and has been actively blocked by the PhishDestroy mitigation service. The threat classification supplied identifies the site as a crypto‑scam that impersonates the brand “Phantom”. Because the site is offline, further behavioural analysis such as payload inspection, credential capture, or redirection chains cannot be confirmed at this time.

Nevertheless, the combination of a fresh registration date, Cloudflare‑based hosting, a zero trust score, multiple vendor detections, and the explicit brand‑impersonation label suggests a high likelihood of fraudulent activity aimed at extracting cryptocurrency or credential information from victims who associate the domain with the legitimate Phantom service. Defenders should immediately add phantom-security.icu to domain blocklists, deny outbound connections to its resolved IP address, and monitor for any future re‑registration or DNS changes. Continuous querying of VirusTotal and other reputation services is advised to capture any new detections.