phantomwallet[.]in

This domain, phantomwallet.in, is identified as a high-risk Solana crypto drainer phishing site designed to impersonate the Phantom wallet interface. The site employs malicious JavaScript to automatically siphon cryptocurrency assets from connected Solana wallets upon user interaction. Infrastructure analysis reveals the use of a drainer kit specifically targeting Solana blockchain transactions, with the page title "Lovable App" serving as a deceptive front to mimic legitimate wallet services. The threat actor behind this campaign exploits social engineering tactics, including fake airdrop promotions and wallet recovery scams, to trick victims into authorizing malicious transactions that result in irreversible asset loss. Technical evidence confirms the malicious nature of this domain through multiple indicators. The domain was registered on February 21, 2026, through HOSTINGER operations, UAB, and resolves to the IP address 185.158.133.1. Detection metrics indicate that 5 out of 95 security vendors on VirusTotal flag this domain as malicious, while it appears on three distinct security blocklists. Additional threat intelligence sources, including AlienVault OTX, have recorded this domain in at least one threat intelligence pulse. The domain is also blocked by multiple wallet security providers, further validating its classification as a crypto drainer phishing site. Cloudflare and HSTS technologies were detected, suggesting attempts to obfuscate the malicious infrastructure and lend an appearance of legitimacy. Users who have interacted with phantomwallet.in should immediately disconnect any connected wallets and revoke all active session permissions. It is critical to transfer remaining assets to a new, secure wallet address and monitor transaction histories for unauthorized activity. Affected individuals should also scan their devices for malware, as crypto drainer campaigns may deploy additional payloads. Given the irreversible nature of cryptocurrency transactions, victims are advised to report the incident to relevant blockchain security teams and law enforcement cybercrime units for further investigation. Proactive measures, such as enabling hardware wallet protections and verifying domain authenticity before interaction, are strongly recommended to mitigate future risks.