phantomwallet[.]site

The domain phantomwallet.site was registered on September 13, 2025 through Spaceship, Inc. and is currently offline after being taken down. Technical traces show it was hosted on Cloudflare's network (AS13335) with the IP address 104.21.77.100 located in the United States. The authoritative nameservers arya.ns.cloudflare.com and damien.ns.cloudflare.com resolve to the same Cloudflare edge. No TLS certificate was presented, indicating the site operated without HTTPS protection.

The page title observed during the brief live period was "Lymcoin – Cryptocurrency," and the domain explicitly impersonates the Phantom brand, fitting a crypto‑scam impersonation pattern. Reputation checks reveal a Gridinsoft trust score of 0 out of 100 and the domain appears on a single security blocklist, where it has been flagged and blocked by PhishDestroy. VirusTotal analysis recorded 8 detections out of 95 scanning engines, reinforcing its malicious classification.

While the exact content of the site beyond the title has not been publicly released, the convergence of brand impersonation, low trust score, multiple vendor detections, and blocklist presence confirms a high‑confidence phishing infrastructure targeting Phantom users. Defenders should continue to block the domain and its associated IP, monitor for future domains using the same Cloudflare nameservers or similar naming patterns, and educate end users to verify URLs before entering wallet credentials. Ongoing surveillance of related Cloudflare‑hosted assets is recommended to detect any re‑deployment of this campaign.