reallocations-pharos[.]org

This domain, reallocations-pharos.org, is identified as a credential harvesting phishing site impersonating FASTPANEL, a web hosting control panel. Analysis indicates the threat specifically targets users attempting to access legitimate FASTPANEL interfaces, presenting a fraudulent login portal to capture authentication credentials. The domain is currently offline, though prior activity suggests it was actively deployed in a targeted phishing campaign. Infrastructure analysis reveals the domain was registered on May 28, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com, a registrar frequently associated with malicious domain registrations. It resolves to the IP address 104.21.60.244, which is part of a content delivery network known to obfuscate hosting origins. The domain is flagged by 3 of 95 security vendors on VirusTotal, indicating limited but confirmed detection. It appears on three independent security blocklists, including domain-based threat intelligence feeds. Technologies detected include Cloudflare and HTTP/3, suggesting the use of modern infrastructure to evade detection and enhance delivery speed. The current offline status of reallocations-pharos.org does not eliminate the risk, as phishing domains frequently resurface under similar naming conventions or are repurposed for other malicious activities. Organizations and individuals are advised to block the domain and its associated IP address at the network perimeter. Users who may have interacted with the domain should immediately rotate any credentials entered on the site and monitor for unauthorized access. Security teams should review logs for connections to 104.21.60.244 and the domain itself, as well as investigate any related subdomains or typosquatting variants. Proactive monitoring for newly registered domains with similar patterns is recommended to mitigate future threats from this campaign.