wallet-pantom[.]framer[.]ai

The domain wallet-pantom.framer.ai was identified as a crypto drainer phishing site, targeting cryptocurrency users by impersonating legitimate services to drain their wallets. This threat type involves fake wallet interfaces that deceive users into connecting their wallets or entering private keys, leading to asset theft. No specific brand was directly impersonated, but the domain name suggests a possible attempt to mimic Pantom or similar platforms.

Technical indicators reveal a high-risk profile: VirusTotal flagged this domain with 12 out of 95 security vendors, indicating broad recognition as malicious. The domain was registered through CSC Corporate Domains, Inc., and resolves to IP address 31.43.161.6. It was created on February 28, 2026, a relatively recent date consistent with phishing campaigns. The SSL certificate was issued by Let's Encrypt (E8), which is common among both legitimate and malicious sites. The domain appears on 3 security blocklists and was not listed on Google Safe Browsing at the time of analysis.

As of the latest check, the domain is offline, with a page title reading 'Site Not Found | Framer.' This suggests the hosting provider or registrar has taken action to disable the site, likely in response to abuse reports. However, users should remain vigilant as similar domains may appear. PhishDestroy recommends avoiding any interactions with wallet-pantom.framer.ai or associated links, and advises using hardware wallets and verifying URLs carefully to prevent crypto drainer attacks.