Security Scan: Phantom Solana dangerous-payload UX battery

Summary

API

This view is built from:

Scan result: counts, verdicts, details, IPs, technologies, hashes/api/v1/result/f74cca84-9a0b-4d78-8bf3-c3137c12472c Domain and IP registration (RDAP)/api/v1/rdap/f74cca84-9a0b-4d78-8bf3-c3137c12472c Certificate Transparency/api/v1/ct/phantom-mobile-test.pages.dev How often this domain was scanned/api/v1/domain/stats/phantom-mobile-test.pages.dev Scan history for this domain/api/v1/domain/history/phantom-mobile-test.pages.dev?limit=15

This website contacted 5 IPs in 1 country across 2 domains to perform 108 HTTP transactions. The main domain is phantom-mobile-test.pages.dev and was registered 6 years ago.

Submitted URL: https://phantom-mobile-test.pages.dev/

AI Security Verdict

Moderate Risk

Confidence: 55%

Risk Score

Security-research test harness on a free pages.dev subdomain that builds Solana wallet-drainer payloads and asks users to connect a wallet. No forms, no Indicators of Compromise, no malware; it self-labels as a test and says not to approve, but the live drainer payloads warrant caution.

Risk Factors (3)

Wallet-drainer-class signing payloads are live on the page and could harm a user who connects a real wallet and approves

Subdomain name and branding invoke Phantom (a third-party wallet) on a domain that is not Phantom's official site

Hosted on a free publishing platform namespace (pages.dev) with no verifiable ownership or age

Safety Factors (5)

Page explicitly states its goal is to observe the signing prompt UI, and instructs 'DO NOT APPROVE'

Zero forms: 0 password fields, 0 disguised-password fields, 0 payment fields

No cross-origin credential exfiltration and no cross-origin JS network targets detected

No Indicators of Compromise, no YARA JavaScript malware patterns, no known malicious kit, no Safe Browsing threats

Single external script host (esm.sh), a popular ranked module CDN

Domain age information unavailable

Details

Page Title

Phantom Solana dangerous-payload UX battery

Scan Type

public

Favicon Hash

MMH3: -885304396

MD5: 09ca7cd78606b1af1551de23c6863d78

Domain Name Analysis

Within the developer-focused generic top-level domain (.dev), 'phantom-mobile-test.pages.dev' is registered with subdomain 'phantom-mobile-test'. The registrable portion 'pages' spans 5 characters with 2 vowels and 3 consonants. Tokenizing the label suggests 1 word: pages. The median word length lands at 5 characters. No strong language cues emerged from the frequency lists.

Screenshot

Page Load Overview

8.60s

Total Load Time

321 KB

Total Size

Language Analysis

Primary Language

🇺🇸English

Code: en

Confidence:55%

Script:Latin

Direction:ltr

Detection Details

Text Length:873 chars

Detector Agreement:100%

Website Classification

Primary Category

technology software43% confidence

Type: static

Method: ml+structural

All Detected Categories

technology software

43%

documentation technical

31%

finance banking

28%

Detected Features

No structural features detected

Domain & IP Information

Requests	IP Address	Location	AS Autonomous System
24	188.114.96.9Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
21	172.67.70.222Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
21	188.114.97.9Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
21	104.26.14.209Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
21	104.26.15.209Cloudflare · WAF	United States	AS13335Cloudflare, Inc.
108	5	-	-