phantomchain.online is a crypto drainer site built to impersonate Phantom, the widely used Solana wallet. It targets Solana users by mimicking the Phantom brand to trick them into connecting their wallets. PhishDestroy first identified it on 2026-09-19, the same day the domain was registered. The site is now dead, with DNS going inactive on 2026-09-20 and confirmed offline as of 2026-10-17.
How the scam works
The site deployed a Solana Drainer kit, a class of malicious tooling designed to silently request broad token approvals or direct transfer signatures the moment a victim connects their Solana wallet. By presenting itself as a legitimate Phantom interface, it exploits user trust to obtain those signatures without revealing what is actually being authorized. Once signed, the drainer sweeps tokens and SOL from the victim's wallet automatically. The page title served by the server is "406 Not Acceptable," which conflicts with the drainer classification; this reflects the server's current state rather than the content that was active during the attack window.
Evidence
Five of 89 engines on VirusTotal flagged this domain on 2026-09-20, with detections from CRDF, Fortinet, Gridinsoft, SOCRadar, and desenmascara.me. While that detection count is low, it is consistent with a very short-lived domain taken down within hours of launch. Spamhaus DBL lists the domain under DBL_SPAM, and it appears in four OTX threat intelligence pulses. PhishDestroy has the domain on its blocklist.
Infrastructure
The domain was registered on 2026-09-19 through NameCheap, Inc., matching the exact date PhishDestroy first detected it, indicating it was stood up and weaponized immediately. Hosting resolves to an IP in the United States. The TLS certificate was issued by Let's Encrypt under the YR1 authority, a free and automated service commonly used for rapid site deployment.
What to do
If you visited this site and connected a Solana wallet, treat the connection as compromised immediately. Use a trusted tool such as a Solana wallet's built-in revoke feature or a reputable approval manager to revoke all token approvals granted to unknown programs. Transfer remaining assets to a freshly generated wallet that has never been exposed to this site. Security teams and wallet providers should add phantomchain.online to their blocklists and push the Spamhaus DBL and OTX pulse data into their threat feeds.
DOM Analysisanalyzed 2026年9月19日score 93/1003 brand signals
IoC Extractionscanned 2026年9月20日0 wallet · 1 Telegram IoC
Submitted URLhttps://phantomchain.online/
Favicon Hash
ICANN OVERSIGHT
认证和 RAA 背景
Registrar accreditation and DNS abuse obligations
For this gTLD, the registrar above operates under an ICANN accreditation agreement. The links below provide the official fee schedule and current DNS abuse compliance guidance.
Accreditation is a contract, not a safety certification.
RAA §3.18 establishes abuse-contact and handling requirements. This report can document stored outbound notices and later technical observations; it does not by itself establish receipt, investigation, remediation, or contractual non-compliance.
Saved certificate metadata. Certificate dates without a timezone are shown as stored. Transport encryption does not establish that the site is trustworthy.
Primary outcomeDNS 非活动reason: DNS NXDOMAIN80% confidence
Attributionsource: Dns Cache
Evidence layersAvailability: DNS inactiveContent: UnreachableDNS: NXDOMAINRegistration: Unknown
Latest HTTP observation未知Probe Inconclusive20%2026-10-19 01:15:51 UTC
RDAP registration未知
Observed timelinelast reachable: 2026-09-19 10:46:23 UTCcurrent episode first observed: 2026-09-30 16:14:55 UTCobserved RIP window: 2026-09-19 10:46:23 UTC → 2026-09-30 16:14:55 UTC · 269.48hmidpoint estimate ≈ 2026-09-25 01:30:39 UTC · precision low · basis bounded
Availability, content, DNS and registration are independent evidence layers. NXDOMAIN, an unreachable origin or missing content alone does not prove registrar action. A registrar or provider is credited only when a direct technical marker identifies that actor. Report causality is shown separately.
JSDelivr is a free public CDN for open-source projects. It can serve web files directly from the npm registry and GitHub repositories without any configuration.
jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax.
您的加密货币交易所 — notify its fraud team immediately; it may be able to preserve records or restrict funds held on its platform
Your bank or payment provider — contact its fraud team promptly through official contact details if money or card information was exposed.
当地警方 — 即使无法立即采取行动，也能留下正式记录
A report is not a guarantee of recovery or investigation, but prompt, accurate transaction data can help authorities and service providers trace the incident.
加密货币诈骗通常是如何运作的？
虚假网站 — 与正规网站完全一致的克隆网站，仅域名略有改动
恶意批准 — “连接钱包”的提示会使攻击者获得无限的代币消费权限
猪的屠宰 — 通过Telegram/WhatsApp/交友软件花数周时间建立信任，随后钱被骗走
退款诈骗 — fraudsters pose as recovery agents and demand upfront fees. Never share a seed phrase or pay before independently verifying the provider
About this reportSources, observation dates and corrections
This report combines saved page captures, registration and network records, scanner results and PhishDestroy reporting history. Each source keeps its own observation date. Open a source report to inspect the original result.
The AI-assisted analysis was written on . It describes the evidence available at that time; later source checks can change.
A capture documents what was shown. A scanner result records that provider’s assessment at the time of its check. Neither a valid certificate nor a zero-detection result is a guarantee of safety.
(US)
