phantxm[.]com

phantxm.com is a newly registered domain (created August 31 2025) owned through GoDaddy.com, LLC. The site presents the page title “PHANTXM” and is classified as a brand‑impersonation campaign targeting the brand Argent. The threat is marked high risk and remains active as of the report date. Infrastructure analysis shows the domain resolves to 23.227.38.32, an address located in Canada and announced by AS13335 (Cloudflare). The DNS configuration uses the generic registrar‑provided nameservers ns13.domaincontrol.com and ns14.domaincontrol.com. An SSL certificate issued by Let’s Encrypt (certificate identifier E8) is in place, and the site enforces HSTS while supporting HTTP/3. Fingerprinting reveals the presence of Shopify, RequireJS, GoAffPro, and Cloudflare components, and the HTTP response is a 301 redirect. Reputation data is poor: Gridinsoft assigns a trust score of 0 / 100, and the domain appears on one security blocklist. VirusTotal reports that 4 of 95 scanned security vendors flag the domain as malicious. The site is also listed as blocked by PhishDestroy. These indicators collectively confirm a malicious intent consistent with the impersonation label. While the page title and technical footprint are confirmed, the exact content served after the redirect has not been analysed, so the specific phishing lures or credential‑capture mechanisms remain unknown. No additional evidence of payload delivery or compromised accounts is currently available. Defenders should immediately block traffic to phantxm.com at perimeter and DNS filtering layers, and add the IP address 23.227.38.32 to threat‑intel watchlists. Continuous monitoring of DNS queries for this domain and its associated nameservers is advised. Users should be warned that any unsolicited communications referencing Argent that direct to this domain are likely fraudulent. Incident response teams should treat any credential submissions to the site as compromised and initiate appropriate remediation.