pharos-app[.]eth[.]limo

PhishDestroy identifies pharos-app.eth.limo as an active fake MetaMask phishing site specifically targeting Ethereum wallet users by spoofing the official login interface. The domain is engineered to harvest private keys, mnemonic phrases, or wallet passwords under the guise of a legitimate authentication portal. Visitors who enter credentials risk immediate loss of funds, as the stolen data grants attackers full control over linked wallets and associated digital assets. This domain was flagged by MetaMask and SEAL, resides on 2 known security blocklists, and currently shows zero detections on VirusTotal out of 95 scanners. Resolving to 3.135.72.151, the site uses a Let’s Encrypt SSL certificate to appear legitimate, though its creation date and registrar remain undisclosed in public records. The absence of widespread detection suggests a recently deployed campaign still in early propagation. If you visited pharos-app.eth.limo, disconnect from the site immediately and do not enter any wallet credentials. Disconnect affected browser sessions, reset network connections, and audit connected wallets using tools like MetaMask’s security check or Etherscan’s token approvals. Consider transferring remaining funds to a newly created wallet with a different seed phrase. Report the incident to your wallet provider and consider revoking any suspicious token approvals via platforms such as Revoke.cash.