phantominvestltd[.]com

Analysis of the domain phantominvestltd.com indicates it was actively impersonating the Phantom brand as part of a cryptocurrency scam. The domain was registered on February 21, 2026, through Tucows Domains Inc. and resolved to the IP address 188.114.96.3, hosted on Cloudflare's infrastructure (AS13335). At the time of assessment on July 23, 2026, the domain returned an HTTP 403 status, with a page title displaying 'phantominvestltd.com | 522: Connection timed out,' suggesting either temporary takedown or backend misconfiguration. Security vendor detections on VirusTotal flagged the domain as malicious, with 14 of 93 engines identifying it as harmful.

The domain also appeared on three security blocklists, including PhishDestroy, MetaMask, and SEAL, reinforcing its classification as a high-risk threat. The SSL certificate, issued by Google Trust Services (WE1), does not mitigate the domain's malicious intent, as threat actors commonly leverage valid certificates to lend false legitimacy to phishing infrastructure. Infrastructure analysis reveals the use of Cloudflare nameservers (harmony.ns.cloudflare.com and kellen.ns.cloudflare.com), a common tactic to obscure hosting origins and evade detection. Gridinsoft assigned a trust score of 0/100, further corroborating the domain's fraudulent nature.

While the exact content of the site remains unanalyzed due to its offline status, the available evidence—including the domain name, scam type classification, and brand impersonation—aligns with known patterns of cryptocurrency investment scams targeting Phantom users. Defenders should treat this domain as confirmed malicious and maintain its inclusion on blocklists. Organizations utilizing Phantom or related cryptocurrency services should monitor for references to phantominvestltd.com in logs, emails, or other communication channels to prevent user exposure.