phantumn[.]com

This domain, phantumn.com, is actively flagged as a high-risk phishing site targeting users of the Phantom wallet service. Analysis indicates the domain was registered on September 20, 2025, through Tucows Domains Inc. and currently resolves to the IP address 23.227.38.32. The page title, 'Phantumn,' closely resembles the legitimate Phantom brand, suggesting an intent to deceive users into believing they are interacting with the official service. Security vendors have detected malicious activity, with 5 out of 95 engines on VirusTotal identifying the domain as harmful, and it appears on two security blocklists, including PhishDestroy and BLP-Malware. Infrastructure analysis reveals the domain has been linked to 23 threat intelligence pulses in AlienVault OTX, indicating widespread recognition of its malicious nature. The Gridinsoft trust score of 0 out of 100 further corroborates its classification as a confirmed phishing site. While the exact content and functionality of the site remain unanalyzed, the available evidence strongly supports its role in brand impersonation, likely designed to harvest credentials or distribute malware under the guise of the Phantom wallet. Defenders should prioritize blocking this domain at the network and endpoint levels to prevent user exposure. Given its active status and the volume of threat intelligence reporting, organizations should also monitor for related indicators of compromise, such as connections to the resolving IP or associated infrastructure. The domain's registration age and continued operation suggest it may persist as a threat unless mitigated through proactive measures. No additional details about the phishing kit or specific attack vectors are currently available, but the alignment with known Phantom wallet impersonation tactics warrants immediate action.