Is app.phanpay.io a scam?

Our automated security review flags app.phanpay.io as dangerous. Multiple threat indicators were detected — treat the site as a scam until proven otherwise.

Is app.phanpay.io safe to use?

No — app.phanpay.io scored 1/100 on our trust scale. We detected active threat indicators, so we recommend avoiding the site entirely.

Does app.phanpay.io have a valid SSL certificate?

Yes. app.phanpay.io presents a valid TLSv1.3 certificate issued by Let's Encrypt · R13, expiring in 61 days. Note that SSL only encrypts the connection — it does not guarantee that the site itself is trustworthy.

Has app.phanpay.io been flagged by antivirus engines?

15 out of 92 antivirus engines in our malware network flagged app.phanpay.io as malicious or suspicious (12 outright malicious). Even one detection is a meaningful signal.

Is app.phanpay.io on any phishing or malware blacklists?

No. app.phanpay.io is not currently listed on the major browser blocklist feeds that modern browsers use.

Where is app.phanpay.io hosted?

app.phanpay.io resolves to an IP operated by Frosty Hosting in RU (usage type: Data Center/Web Hosting/Transit). Hosting location alone doesn't make a site good or bad, but unusual geography for a brand's claimed country is one of many signals we weigh.

How often is the app.phanpay.io report updated?

We cache results for 24 hours. Signed-in MalwareTips members can trigger a manual rescan at any time using the "Rescan" button on the report page, which re-runs every check from scratch and refreshes this page.

DANGEROUS

Crypto scam / wallet-drainer

12 of 92 antivirus engines flag this page as malicious. Signals match fake investment platforms and wallet drainers. Never connect a wallet, paste a seed phrase, or deposit crypto here.

Security Review

Is app.phanpay.io legit or a scam?

Name: Is app.phanpay.io legit or a scam?
Item: app.phanpay.io
Rating: 1
Author: MalwareTips

Our verdict:Dangerous· 1/100

SafeSuspiciousDangerous

Phantom Wallet phishing page designed to steal wallet credentials through fake connection flow.

Top reasons

Six antivirus engines flag as phishing (Cluster25, CRDF, CyRadar, ESET, Forcepoint ThreatSeeker, G-Data).Impersonates Phantom Wallet on non-official domain app.phanpay.io with nearly identical branding and interface.Matched to crypto-only checkout scam family, a known credential-harvesting pattern targeting wallet users.

app.phanpay.ioScanned 1h ago

Post Facebook

Trust score

DANGEROUS

Heuristics 0·MT 18

Category tags

phishingcrypto fraud#Phishing#Crypto Drainer#Clone Site92% MT confidence

Technical red flags (3)

15 of 92 engines flaggedImpersonates PhantomCrypto-Only Checkout

Positive signals (3)

Not on major blacklists Encrypted connection Clean server reputation

These checks passed — but they don't clear the site. A clean antivirus result, valid SSL, and a calm server only mean it isn't hosting malware; they say nothing about whether the business is real. This verdict is based on the site's conduct and content, not a malware detection.

Wallet-drainer patterns detected

This page uses language and API references consistent with modern crypto wallet-drainer kits. If you connected your wallet or signed a transaction on this site, assume your wallet is compromised — revoke approvals, move funds to a fresh wallet with a new seed phrase, and treat the original as burned.

·Page asks for a wallet seed phrase / recovery phrase — legitimate wallets never do this.

Revoke token approvals File FBI IC3 report

View density

Analysis Summary

Threat Intelligence

15/92

Engines flagged this URL

Domain Age

—

Registration date unknown

MT Intelligence

Dangerous

Critical likelihood · 92% confidence

MT Intelligence

Advanced threat intelligence

MT Security Analyst

Critical scam likelihoodengineMT · Guardiantrust18/100

MT AgentLive web researchVisual inspectionNetwork correlation

Confidence

The page impersonates Phantom Wallet—a legitimate cryptocurrency wallet—on the non-official domain app.phanpay.io, presenting itself as 'PhanPay' with a nearly identical interface and connection prompt. Six antivirus engines (Cluster25, CRDF, CyRadar, ESET, Forcepoint ThreatSeeker, G-Data) independently flagged it as phishing. The page body contains classic credential-harvest language ('Connect your Phantom wallet, ready in 30 seconds') and mimics Phantom's security messaging to build false trust. Our scam-family detector matched it to the crypto-only checkout pattern, which targets users by impersonating legitimate wallet services. The domain has no legitimate business registration, no contact information, and loads external resources from suspicious third-party hosts. The combination of brand impersonation, antivirus consensus, and scam-family match leaves no ambiguity.

Full dossier

Analysis complete

Page Content

The page presents itself as 'PhanPay — Connect Your Phantom Wallet' and mimics Phantom Wallet's interface and messaging. It claims to offer non-custodial wallet features (off-ramp, price alerts, bulk burn, whale tracker) and uses reassuring language ('We can't touch your keys', 'Open Source', 'Audited CertiK') to build false credibility. The body text includes fake testimonials and pricing tiers ($25/mo, $49/mo, $99/mo) to appear legitimate. No genuine contact email, postal address, or social links are present.

Infrastructure

Hosted on IP 94.183.168.68 with valid SSL (Let's Encrypt, 61 days to expiry). The domain loads external resources from fonts.googleapis.com and bulgur-roman.web-dist.cc (a suspicious third-party host). No WHOIS data is available, and the domain is not indexed in global traffic rankings, indicating either very recent registration or deliberate obscurity.

Domain History

WHOIS information is unavailable, preventing verification of registration date or registrant details. The lack of traffic indexing and absence of legitimate business registration strongly suggest this is a newly deployed phishing infrastructure.

Web Reputation

Six major antivirus engines flag the page as phishing: Cluster25, CRDF, CyRadar, ESET, Forcepoint ThreatSeeker, and G-Data. Our scam-family detector matched it to the crypto-only checkout pattern. Browser blocklists remain clean (likely due to recent deployment), but the antivirus consensus is overwhelming. No positive reviews or trust mentions exist.

Risk Factors

Six antivirus engines flag as phishing (Cluster25, CRDF, CyRadar, ESET, Forcepoint ThreatSeeker, G-Data).
Impersonates Phantom Wallet on non-official domain app.phanpay.io with nearly identical branding and interface.
Matched to crypto-only checkout scam family, a known credential-harvesting pattern targeting wallet users.
No legitimate business registration, contact email, postal address, or social presence.
Loads external resources from suspicious third-party host (bulgur-roman.web-dist.cc).
WHOIS data unavailable and domain not indexed in global traffic rankings, indicating recent or hidden deployment.
Uses reassuring security language ('non-custodial', 'audited', 'open source') to build false trust before credential harvest.

Positive Signals

SSL certificate is valid and issued by Let's Encrypt.

AI Recommendation

Do not connect your wallet or enter any credentials on this page. If you have already connected your wallet, immediately transfer your funds to a new wallet address and revoke all permissions from this domain in Phantom's settings. Report this phishing page to Phantom's security team and your antivirus provider.

Scam network detected

Related infrastructure identified

Matched to crypto-only checkout scam family. Impersonates Phantom Wallet, a legitimate Solana cryptocurrency wallet, to harvest user credentials and wallet access.

Next-gen fraud intelligence

Evidence-backedCross-checked

Website Preview

LIVE RENDER

app.phanpay.io

1Impersonates Phantom

Automated page render — captured in a safe sandbox. What an ordinary visitor would see when loading the site. See full visual analysis →

Web Research Findings

Our live research agent queries scam-report databases, consumer-review sites, news coverage, and general web search for app.phanpay.io, then cross-checks business-registration records and look-alike domain patterns. Everything below is pulled from what it actually found.

Web mentions

No scam reports found

No complaints, no negative coverage turned up in our sweep.

Research summary

Narrative write-up from our AI analyst

No independent review aggregator data available for this domain.

Antivirus Engines

Detection matrix · live

15 engines flagged this URL

We cross-check every URL against our antivirus network of 92 malware and blacklist engines. Each detection is listed below by engine name — even a single hit is a meaningful signal.

12Malicious3Suspicious48Harmless92Engines

of 92

Cluster25

Malicious· phishing

CRDF

Malicious· malicious

CyRadar

Malicious· phishing

ESET

Malicious· phishing

Forcepoint ThreatSeeker

Malicious· phishing

G-Data

Malicious· phishing

Kaspersky

Malicious· phishing

MalwareURL

Malicious· phishing

OpenPhish

Malicious· phishing

SOCRadar

Malicious· phishing

Sophos

Malicious· phishing

Webroot

Malicious· malicious

alphaMountain.ai

Suspicious· suspicious

Fortinet

Suspicious· spam

Gridinsoft

Suspicious· suspicious

15 antivirus engines flagged this URL. Even a single detection is a meaningful signal — treat this site with extra caution and avoid entering credentials, payment info, or downloading any files.

Security Scans

Blacklist Check

Not flagged on major threat lists

Checked against the major public blocklists used by browsers and security tools — no hits.

Sandbox Render

Sandbox capture incomplete — no traffic recorded

Requests made0

Unique IPs0

Countries0

Detected brandsNone

Contact Verification

We fetched the page and looked for real-world contact details. Legitimate businesses almost always publish an email on their own domain, a phone number, and a postal address. Scam shops usually don't.

What We Found

No clear contact details on the page

Emails on site's domainNone

Phone numbers0.000041

Postal addressNot listed

Linked social profiles0

Signal Summary

Several contact red flags

No contact email found anywhere on the page.
No postal address visible on the page.
Page impersonates Phantom on a non-official domain.
Scam family match: Crypto-Only Checkout.

Phone number listed (0.000041).

Domain & Encryption

Encryption Certificate

StatusValid

ProtocolTLSv1.3

IssuerLet's Encrypt · R13

ExpiresAug 8, 2026 (61d)

Self-signedNo

Hosting & Technology

HostingFrosty Hosting

Server locationRU

Web servernginx

Redirect Chain

Hops

Cross-domain

Lookalike

Punycode

1301http://app.phanpay.io/
2302https://app.phanpay.io/
3200https://app.phanpay.io/en/

Server Reputation

Hosting

CountryUnknown

NetworkUnknown

IP addressUnknown

Abuse Intelligence

Confidence score0%

Reports on file1

ISPFrosty Hosting

Usage typeData Center/Web Hosting/Transit

Scam-Type Likelihood

4 scam-type patterns detected

Scam-Type Likelihood

4 of 13 categories showed signals

We check every URL against 13 distinct scam categories so the verdict tells you not just how risky the page is, but what kind of risk it carries. Each meter pulls from page signals, web reports, our AI analyst, vision, and the scam-network cluster — not from raw AV labels.

Top match: Crypto Fraud

Crypto Fraud

High likelihood

61/100

AI analyst tagged this as crypto fraud / wallet-drainer.
Page asks for wallet connect or seed-phrase / private key.
AI analyst categorised the site as crypto-themed.

Brand Impersonation

High likelihood

60/100

Page claims to be Phantom.
AI analyst tagged this as a brand / clone-site impersonation.

Fake Shop

Low-level signals

23/100

Crypto-only checkout — no card / bank payment option.
Multiple contact / trust-signal red flags on the page.

Phishing

Low-level signals

10/100

AI analyst tagged this as phishing.

Scam-Type Likelihood

4 of 13 categories showed signals

Top match: Crypto Fraud

Crypto Fraud

High likelihood

61/100

AI analyst tagged this as crypto fraud / wallet-drainer.
Page asks for wallet connect or seed-phrase / private key.
AI analyst categorised the site as crypto-themed.

Brand Impersonation

High likelihood

60/100

Page claims to be Phantom.
AI analyst tagged this as a brand / clone-site impersonation.

Fake Shop

Low-level signals

23/100

Crypto-only checkout — no card / bank payment option.
Multiple contact / trust-signal red flags on the page.

Phishing

Low-level signals

10/100

AI analyst tagged this as phishing.

Crypto scam / wallet-drainer indicators

The page shows patterns common to crypto-investment scams, fake airdrops, and wallet drainers.

Do not interact with app.phanpay.io
Do not enter credentials, deposit money, download files, or install browser extensions from this site.
Never paste your seed phrase anywhere
Legitimate wallets, exchanges and support staff will never ask for your 12/24-word recovery phrase. Typing it into any website — even one that looks real — gives attackers full access to your funds.
If you already connected a wallet
Revoke token approvals immediately using revoke.cash or Etherscan's Token Approvals tool. Move remaining funds to a fresh wallet (new seed phrase). Assume the original wallet is compromised.
Report the wallet and URL
File a report at IC3 (FBI Internet Crime Complaint Center) or your country's cybercrime portal. Recovery is unlikely, but reports help law enforcement map the network.
Open

Reputation Sources

How this domain rates across independent threat-intelligence and blocklist providers.

Google Safe Browsing

Not listedCheck ↗

VirusTotal

ListedCheck ↗

AbuseIPDB

Not listedCheck ↗

Also verify:Spamhaus ↗DNSBL / SURBL ↗PhishTank ↗

Referenced Domains

Outbound domains this page links to or loads resources from. Each links to its own security scan.

fonts.googleapis.com bulgur-roman.web-dist.cc main_url_buraya_yaz

Safety FAQ

Common questions about this site, answered directly from the scan data above — so the answers always reflect the latest verdict on this page.

Our automated security review flags app.phanpay.io as dangerous. Multiple threat indicators were detected — treat the site as a scam until proven otherwise.
No — app.phanpay.io scored 1/100 on our trust scale. We detected active threat indicators, so we recommend avoiding the site entirely.
Yes. app.phanpay.io presents a valid TLSv1.3 certificate issued by Let's Encrypt · R13, expiring in 61 days. Note that SSL only encrypts the connection — it does not guarantee that the site itself is trustworthy.
15 out of 92 antivirus engines in our malware network flagged app.phanpay.io as malicious or suspicious (12 outright malicious). Even one detection is a meaningful signal.
No. app.phanpay.io is not currently listed on the major browser blocklist feeds that modern browsers use.
app.phanpay.io resolves to an IP operated by Frosty Hosting in RU (usage type: Data Center/Web Hosting/Transit). Hosting location alone doesn't make a site good or bad, but unusual geography for a brand's claimed country is one of many signals we weigh.
We cache results for 24 hours. Signed-in MalwareTips members can trigger a manual rescan at any time using the "Rescan" button on the report page, which re-runs every check from scratch and refreshes this page.

Final Verdict

Trust / 100

Final Verdict·app.phanpay.io

DANGEROUS

This is a phishing page impersonating Phantom Wallet on a fake domain. Six antivirus engines flag it as phishing, the page mimics Phantom's branding and wallet-connection flow to harvest credentials, and it matches the crypto-only checkout scam family.

AV engines

MT passes

Net signals

Scan another URL

Security review completemalwaretips.com/url-scan

Recently scanned

Other Dangerous reports

proposals-firelightfoundation.com

1h ago

Read the review

Dangeroustrust1

nftbancusportal.pages.dev

get-xrplfoundation.com

Community review

User reviews & comments(0)

Share your experience — "Lost $200 on a fake checkout" is more useful than "Scam". Your review helps others avoid traps.

Loading…

Loading comments…

This report is generated automatically by combining threat intelligence, domain signals, and an AI security analyst. It is informational, not legal advice. Always use your own judgement before sharing personal information or money online.