pharostestnet[.]com

This domain, pharostestnet.com, is flagged as a high-risk brand impersonation scam designed to deceive users into participating in a fraudulent airdrop. The site mimics the Pharos Network, a legitimate blockchain project, by offering fictitious PROS tokens under the guise of a "Pharos Airdrop | Claim PROS Tokens - Pharos Network Mainnet" campaign. Analysis indicates this is a classic airdrop scam, a subtype of brand impersonation, where victims are lured into connecting wallets or disclosing private keys, leading to potential asset theft or crypto drainer attacks. No specific drainer kit signatures were identified in the available data, but the infrastructure aligns with known airdrop fraud patterns targeting cryptocurrency users.

Infrastructure analysis reveals multiple technical indicators of compromise. The domain resolves to the IP address 104.21.87.51, a Cloudflare-protected endpoint leveraging HTTP/3 and HSTS for apparent legitimacy. It was registered on April 14, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com, a registrar frequently associated with high-risk domains. VirusTotal reports 13 out of 95 security vendors flagging the domain as malicious, while Gridinsoft assigns a trust score of 0/100. The domain appears on four security blocklists and is actively blocked by MetaMask, PhishDestroy, SEAL, and ScamSniffer. Technologies detected include Cloudflare Browser Insights, further suggesting an attempt to obfuscate malicious intent behind a legitimate-seeming facade.

As of the latest assessment, pharostestnet.com has been taken offline, likely due to enforcement actions by security providers or hosting interventions. However, residual risk persists due to the domain's recent creation and the transient nature of such scams. Users who interacted with the site should immediately revoke any connected wallet permissions, monitor for unauthorized transactions, and rotate credentials for associated accounts. Organizations are advised to update blocklists with the domain and IP, while security teams should treat any residual DNS queries or cached pages as indicators of compromise. Proactive monitoring for similar domains using the "Pharos Airdrop" or "PROS Tokens" branding is recommended to mitigate further exposure.