ScanMalware.com

Security Scan Report: phantom-wallet-i4l.pages.dev

Site favicon
Submitted: Completed: publiccompleted

Summary

API
This view is built from:
Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/331ff233-9fb8-4060-9555-03131269b9aeDomain and IP registration (RDAP)/api/v1/rdap/331ff233-9fb8-4060-9555-03131269b9aeHow often this domain was scanned/api/v1/domain/stats/phantom-wallet-i4l.pages.devScan history for this domain/api/v1/domain/history/phantom-wallet-i4l.pages.dev?limit=15
This website contacted 2 IPs in 1 country across 1 domain to perform 8 HTTP transactions. The main domain is pages.dev and was registered 6 years ago.

Submitted URL: https://phantom-wallet-i4l.pages.dev/home/import/

AI Security Verdict

Confirmed Scam

Confidence: 98%

10
Risk Score

Phishing page impersonating Phantom Wallet on pages.dev, harvesting seed phrases and private keys through 13 password fields — immediate wallet-draining risk. Do not enter any phrase or key.

Risk Factors (5)
Impersonation of the Phantom Wallet brand on a non-official domain
Harvesting of cryptocurrency seed phrases / private keys via 13 password fields
Password field present without any username/email field (suspicious credential-harvesting pattern)
Cross-origin lookup of a TXT record on suspicious domain api.v1techdomainsec.sbs
Free hosting-platform subdomain with unknown age and no domain reputation
Domain age information unavailable

Details

Page Title

Phantom Wallet

Scan Type

public

Domain Name Analysis

Domain 'phantom-wallet-i4l.pages.dev' uses the developer-focused generic top-level domain (.dev); it also runs on subdomain 'phantom-wallet-i4l'. Count 5 characters in 'pages' split between 2 vowels and three consonants. Breaking it apart gives 1 word: pages. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of https://phantom-wallet-i4l.pages.dev/home/import/

Page Load Overview

12.30s
Total Load Time
218 KB
Total Size

Language Analysis

Primary Language

🇺🇸English
Code: en
Confidence:80%
Script:Latin
Direction:ltr

Detection Details

HTML Lang Attribute:en
Text Length:307 chars
Detector Agreement:100%

Website Classification

Primary Category

finance banking64% confidence
Type: dynamic
Method: ml+structural

All Detected Categories

finance banking
64%
cryptocurrency blockchain
51%
healthcare medical
49%
technology software
46%
documentation technical
43%

Detected Features

No structural features detected

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
4172.66.47.155Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
4172.66.44.101Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
82--

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T141729629A075243B061358B563D9B70F798A454BED47C8007ABC57490FD1E92CBB7EE8

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

384:5GJrECMyec+4wYdMh8Ho72Bt4WneU3gUE6zZblMVE6zZhG:qrEiecc8I7cBneU3gU3FWV3TG

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:16246:khIpqARxqGSGBMEln2T2AE1COhVGQ7ggy0IUHbhLxBdaEUBGA1yRSAgMgEDACRMlGECAAwwIiSQhUlAJ4liJDAmCShyILAFa

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:ffe7e7dbdbe7e7ff
Perceptual Hash:e6cc6633993266cc
Difference Hash:10080412324c4c30
Wavelet Hash:fbc3c3db1b030307
Color Hash:#7740bf

Other Hashes

Crop Resistant:10080412324c4c30

Scan History

Scan history not available

Unable to load historical scan data