Criticalscore 74 · flagged Monday, August 31, 2026

phantom-vpn.top

Appeared in the .top zone on Monday, August 31, 2026; by the end of that day the census found active website about jobs recruiting. Full domain report

Signals, not verdicts. A domain appears here because heuristics matched its name, its infrastructure or the page it served on its first day. Where a model has looked at it, that is shown as an opinion with a confidence, not as a finding. Nothing on this page says a site is malicious. Read the evidence and decide for yourself.

Own one of these names and think the listing is wrong? Tell us and a person will look.

What matched

ambiguous brand word
matched: phantom
+4
TLD with a high abuse rate
matched: top
+8
brand name behind Cloudflare
matched: cloudflare.com
+6
brand name at a retail registrar
matched: NICENIC INTERNATIONAL GROUP CO., LIMITED
+8
brand name at a watch-list registrar
matched: NICENIC INTERNATIONAL GROUP CO., LIMITED
+6
page impersonates a brand
matched: Netflix
+22
brand in page title, not in the name
matched: instagram
+20
Registrar
NICENIC INTERNATIONAL GROUP CO., LIMITED
Nameserver provider
Nameservers
amalia.ns.cloudflare.com, marty.ns.cloudflare.com
First-day state
active website
HTTP status
200
Page title
Phantom VPN — обход блокировок YouTube, Instagram, Telegram, WhatsApp в РФ
Has a form
no
Brand echoed
phantom

Model opinions

Second opinionlooks benignconfidence 72%· claude-opus-5

Self-branded Russian-language VPN promo page for 'Phantom VPN' with a Telegram bot signup; the YouTube/Instagram/Netflix mentions are a list of unblockable services, not brand impersonation, and there is no credential or payment form. Cheap .top/NiceNIC registration and Telegram-only contact keep it low-trust but nothing here is deceptive.

First passlooks like a scamconfidence 85%· claude-haiku-4-5

The page promotes a VPN service under the 'Phantom VPN' brand with its own branding and infrastructure, not impersonating a specific organisation. However, it is a scam because it falsely claims to bypass Russian state censorship blocks ('обход блокировок') on services like YouTube, Instagram, and Telegram in Russia—services that are blocked or restricted by law there. The operator contact via Telegram bot (@phantom_vpn_robot) and the 'no logs' guarantee are classic indicators of a fraudulent VP

A model looked at the screenshot and page text and wrote what it thought. It can be wrong, and it is not a finding.

What the page looked like on Monday, August 31, 2026

Screenshot of phantom-vpn.top taken by the zone census on 2026-08-31

Same data as JSON: /api/zone/domain/phantom-vpn.top. This page is not indexed by search engines and does not link to the site it describes.