phantom-wallet[.]co[.]com

This domain, phantom-wallet.co.com, is identified as a high-risk brand impersonation phishing site targeting the Phantom cryptocurrency wallet. The domain is currently offline and was previously hosted in Germany through AS199785 Cloud Hosting Solutions, Limited. Infrastructure analysis reveals that the domain was resolving to the IP address 144.31.194.100 and utilized nameservers a.dnspod.com, b.dnspod.com, and c.dnspod.com.

The site did not have an SSL certificate, which is a red flag for potential phishing activities. The page title, 'Phantom Wallet — Guides, Setup, Security, Swaps, NFTs', suggests that the domain was designed to mimic legitimate content related to the Phantom wallet, potentially to trick users into sharing sensitive information or performing transactions. The domain appears on four security blocklists, including PhishDestroy, Polkadot, Enkrypt, and Codeesura, indicating that it has been flagged by multiple threat detection systems.

Given the high risk level and the absence of a legitimate SSL certificate, defenders should treat this domain as a significant threat and ensure it is blocked at the network level to prevent access. Additionally, monitoring for any related infrastructure or new domain registrations is advised to stay ahead of potential re-emergence or similar attacks. Defenders should also educate users about the importance of verifying the legitimacy of URLs and the presence of SSL certificates when accessing financial services online.