app.phanpay.io
Catégorie : Suspicious
Pour utiliser le produit avec toutes ses fonctionnalités, vous devez acheter une licence pour Combo Cleaner. Essai gratuit limité à sept jours. Combo Cleaner appartient à et est exploité par RCS LT, la société mère de PCRisk.com.
Description de app.phanpay.io
The domain app.phanpay.io appears to present itself as a cryptocurrency-related web application focused on connecting a Phantom wallet. Based on the page title, on-page text, and screenshot, the site claims to offer a quick wallet-connection flow under the name “PhanPay,” with navigation items such as Features, Pricing, Docs, Privacy, and Terms. The branding and wording suggest a service aimed at users of the Phantom crypto wallet ecosystem rather than a general informational website.
The operator is not clearly identified in the provided scan data. The domain is hosted on a subdomain under phanpay.io and appears to be a relatively new project, with registration dating back only a few weeks at the time of this scan. Given the wallet-connection theme and the site’s emphasis on linking a crypto wallet, visitors would likely be asked to authorize wallet access or interact with blockchain-related prompts, which can carry elevated risk when the service is not well established.
Évaluation de sécurité de app.phanpay.io
Multiple security signals indicate elevated risk at the time of this scan. The domain was flagged by 17 out of 91 security engines, and several web-classification sources categorized it as phishing or fraud-related. The page also appears to center on connecting a Phantom wallet, which is a common lure theme in cryptocurrency credential theft and wallet-draining campaigns. In addition, the domain is very new, not ranked among popular sites, and uses branding that may be confused with the well-known Phantom wallet name.
At the same time, the malware scan did not identify malicious files on the page itself, and major blacklist and threat-database checks included in the scan were reported as clean at that moment. That combination can occur with newer phishing pages, especially when the primary risk comes from deceptive wallet prompts or social-engineering flows rather than downloadable malware.
Considering the multi-engine phishing detections, the crypto-wallet theme, and the young age of the domain, this website may pose potential risks to visitors. Based on these findings, users should exercise a high degree of caution before connecting a wallet, approving transactions, or entering sensitive information.
Description technique
The site was reachable over HTTPS with a valid Let's Encrypt certificate, fronted by an nginx web server. The domain is very new, registered through Dynadot, uses ns1.dyna-ns.net and ns2.dyna-ns.net nameservers, and does not appear to have DNSSEC enabled. Hosting was identified as FrostyHosting on IP address 94.183.168.68, geolocated to Moscow, Russia.
No malicious files, flagged external links, or iframes were identified by the page-level malware scan at the time of analysis. However, the site loads an external script from a third-party domain, and the combination of recent registration, unsigned DNS, and strong phishing-related reputation signals increases uncertainty. A valid TLS certificate only confirms encrypted transport and should not be treated as proof of legitimacy.
Partagez votre expérience avec ce site web. Était-il sûr ? Avez-vous rencontré des problèmes ?