pharoscores[.]xyz

PhishDestroy identifies pharoscores.xyz as an elevated-risk crypto drainer, a specific type of generic phishing designed to steal cryptocurrency wallet credentials. This domain was not a mere credential phishing page but a targeted crypto drainer, making it particularly dangerous for users involved in digital assets. The domain is now offline, but its history raises significant concerns for anyone who may have interacted with it.

VirusTotal flagged pharoscores.xyz with 1 out of 95 security vendors detecting malicious activity, a low but notable signal given the specialized nature of crypto draining. The domain was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on May 18, 2026, and resolves to IP 188.114.96.3, which is associated with Cloudflare. It appeared on two security blocklists and was found in one AlienVault OTX threat intelligence pulse. The SSL certificate was issued by Let's Encrypt (E7), a common choice for phishing sites due to its free and automated issuance. Despite the low VT detection rate, the combination of a recent creation date, blocklist presence, and threat intelligence pulse supports the elevated risk assessment.

Users who encountered pharoscores.xyz should immediately check their cryptocurrency wallets for unauthorized transactions and enable two-factor authentication if not already active. Since crypto drainers often harvest private keys or seed phrases, affected users should transfer funds to a new wallet with fresh credentials. Additionally, run a full security scan on any device used to access the domain, as crypto drainers may deploy browser-based scripts or malware. PhishDestroy recommends vigilance against any unsolicited requests for wallet recovery phrases and verifying domain authenticity before connecting wallets to any site.