reallocation-pharos[.]org

The domain reallocation-pharos.org was registered on May 19, 2026 and is currently active. The site presents a page titled “Pharos RealFi Access Program” and returns HTTP 200. The content is consistent with a credential‑harvesting campaign targeting users of financial or crypto services. Infrastructure analysis shows the domain resolves to 172.67.207.208, an address owned by Cloudflare, Inc. The IP geolocates to California, United States. DNS is served by the Cloudflare authoritative name servers elisabeth.ns.cloudflare.com and watson.ns.cloudflare.com. The TLS certificate is issued by Let’s Encrypt (E8), indicating a valid HTTPS endpoint despite the malicious intent. Threat intelligence reports indicate that 2 of 95 security vendors on VirusTotal have flagged the domain, and the domain appears on three public blocklists, including PhishDestroy, MetaMask, and SEAL. Gridinsoft assigns a trust score of 0 out of 100. AlienVault OTX references the domain in a single pulse, confirming its use in at least one observed phishing operation. No additional malware payloads or command‑and‑control infrastructure have been publicly disclosed, leaving the exact data‑exfiltration mechanisms uncertain. Defenders should add reallocation-pharos.org to network deny lists and configure email gateways to quarantine messages that reference the “Pharos RealFi Access Program” wording or the domain itself. Continuous monitoring of the associated IP address and the Cloudflare name servers is advised, as the attacker may shift hosting to other Cloudflare‑controlled IPs. Incident response teams should also collect any phishing emails that reference this domain for further forensic analysis.