phantomcard[.]online

Analysis of phantomcard.online indicates a high‑risk crypto‑drainer operation targeting users of the Phantom wallet. The domain was registered on March 06, 2026 through Hostinger Operations, UAB and resolves to the Amazon‑owned address 35.157.26.135 located in Germany (AS16509). Four nsone.net name servers (dns1.p04.nsone.net through dns4.p04.nsone.net) serve the domain, and no TLS certificate is presented, leaving the site exposed to plain‑HTTP interception. The page title returned from the host, “PHANTOMCARD | Secure Bank Activation”, explicitly references the Phantom brand, confirming impersonation of the legitimate wallet service.

The infrastructure is linked to the Solana Drainer kit, a known malicious script used to exfiltrate cryptocurrency from compromised wallets. VirusTotal scans show that two of ninety‑four security vendors flagged the domain, and three independent blocklists (PhishDestroy, MetaMask, SEAL) have already listed it as malicious. The domain appears on three additional security blocklists, reinforcing the consensus that it is being used for fraudulent activity. Current host status is offline, preventing live content inspection, but the combination of brand impersonation, drainer kit attribution, and multiple detections provides sufficient confidence to treat the domain as a confirmed crypto‑draining threat.

Defenders should add phantomcard.online to DNS and proxy blocklists, monitor traffic to the associated IP address for any residual connections, and enforce strict outbound controls for Solana‑related transactions. Email gateways should flag any messages containing the domain or its URL patterns, and users of the Phantom wallet should be warned not to interact with any activation links originating from this domain. Continuous observation of the IP’s activity within the Amazon network is recommended, as the hosting provider may be leveraged for future campaigns.