pharaoh[.]finance

On July 23, 2026, the domain pharaoh.finance was observed hosting a brand‑impersonation campaign targeting Revolut. The site presented the page title “Pharaoh Exchange: Revolutionizing Cryptocurrency Trading,” suggesting a cryptocurrency‑focused façade, but no further content was captured before the host was taken offline. DNS resolution points to the IPv4 address 66.63.187.97, which belongs to AS36352 (HostPapa) located in the United States. The authoritative name servers are jeff.ns.cloudflare.com and hope.ns.cloudflare.com, indicating the use of Cloudflare’s DNS service. HTTP traffic was terminated over TLS with a Let’s Encrypt certificate (R12), confirming a valid but freely issued certificate.

The web server identified by banner analysis is Nginx. The domain appears on a single security blocklist and is actively blocked by PhishDestroy. VirusTotal analysis recorded 13 detections out of 95 scanning engines, reinforcing the malicious classification. AlienVault OTX references the domain in one threat‑intelligence pulse, and Gridinsoft assigned a trust score of 0 / 100, reflecting a high confidence of abuse. Registration information lists Web Commerce Communications Limited dba WebNic.cc as the registrar; no additional registrant details were disclosed.

Because the site is currently offline, direct observation of the phishing page content, credential‑capture mechanisms, or additional infrastructure cannot be confirmed. Analysts should monitor the associated IP address and name‑server pair for re‑use, and incorporate the domain into URL filtering and DNS block policies targeting Revolut‑related impersonation. Continuous re‑scanning with multi‑engine services is recommended to capture any future changes in detection scores. Coordination with the hosting provider (HostPapa) and Cloudflare may facilitate takedown or mitigation if the domain resurfaces.