phantomwalletextensiondownload[.]blogspot[.]hk

The domain phantomwalletextensiondownload.blogspot.hk is a high-risk phishing site engaged in brand impersonation targeting Phantom, a cryptocurrency wallet provider. It posed as a legitimate source for downloading the Phantom wallet extension but was designed to deceive users into exposing sensitive information or funds. The site is currently taken offline, though it previously operated as a cryptocurrency scam without an associated drainer kit.

Technical analysis of phantomwalletextensiondownload.blogspot.hk reveals 14 of 95 VirusTotal security vendors flagged the domain, including ADMINUSLabs, alphaMountain.ai, and BitDefender. The domain was registered through MarkMonitor, Inc. on November 27, 2010, and resolved to the IP address 142.250.185.129, hosted by Google LLC in the US. It appeared on three security blocklists: PhishDestroy, MetaMask, and SEAL. The SSL certificate was issued by Google Trust Services / WE2, and the observed page title was 'Phantom wallet extension download'. Technologies detected included Blogger, Java, Python, OpenGSE, Clipboard.js, and HTTP/3. Google Safe Browsing did not flag the domain at the time of assessment.

Users who interacted with phantomwalletextensiondownload.blogspot.hk should immediately revoke any token approvals and transfer remaining funds to a new, secure wallet. Enable two-factor authentication (2FA) on all cryptocurrency accounts and monitor for unauthorized transactions. Report the phishing domain to the impersonated brand (Phantom) and submit it to platforms like Google Safe Browsing, PhishTank, or the Anti-Phishing Working Group (APWG) to prevent further abuse.