phantomscannabliss[.]com

This domain is flagged as a critical-risk crypto drainer infrastructure targeting users of the Phantom wallet service. Analysis indicates the site operates a Solana-specific drainer kit designed to siphon cryptocurrency assets by exploiting wallet connection prompts and transaction signing requests. The infrastructure impersonates Phantom branding to deceive victims into authorizing malicious transactions, a tactic consistent with observed drainer campaigns in the Solana ecosystem. Infrastructure analysis reveals the domain phantomscannabliss.com was registered on June 15, 2026, through Squarespace Domains II LLC. It resolves to the IP address 74.208.236.132 and is currently active, displaying the page title 'Hacked By MR.GREEN.' The domain is detected by 4 out of 95 security vendors on VirusTotal and appears on three independent security blocklists. SSL certification is provided by Sectigo Limited under the Sectigo Public Server Authentication CA DV R36 authority. The domain has been proactively blocked by multiple wallet security layers, indicating prior detection and validation of its malicious intent. Mitigation against this threat requires immediate action from both end users and network defenders. Users should verify wallet connection prompts by cross-referencing the domain URL with official Phantom communication channels before approving any transactions. Network-level protections should include blocking the domain, its resolving IP, and associated SSL certificate fingerprints. Wallet providers are advised to integrate real-time domain reputation checks to prevent interaction with known drainer infrastructure. Given the domain's registration date and active status, continued monitoring for related infrastructure is recommended, as threat actors frequently rotate domains to evade detection.