pyth-luma[.]com

This domain is flagged as a high-risk cryptocurrency phishing site designed to deceive users into disclosing wallet credentials or private keys. Analysis indicates the infrastructure is tailored to impersonate legitimate wallet verification processes, a common tactic in cryptocurrency theft operations. The domain exhibits multiple technical indicators of malicious intent, including its recent creation, use of evasion techniques, and broad detection across security platforms. Infrastructure analysis reveals the following concrete data points: the domain pyth-luma.com was registered on March 16, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED. It resolves to the IP address 104.21.80.229 and employs Cloudflare with HTTP/3 support, alongside Cloudflare Browser Insights, likely to obfuscate its origin and evade detection. The domain is currently offline but was previously flagged by 16 out of 95 security vendors on VirusTotal and appears on three security blocklists. Additional detections include blocking by cryptocurrency-specific security tools, with a trust score of 0/100 from Gridinsoft. The page title 'Just a moment...' is consistent with Cloudflare interstitial pages, which are often abused to mask phishing content during initial access attempts. To mitigate risks associated with this threat type, users should verify domain registration dates and ownership details before interacting with any cryptocurrency-related site. If credentials or private keys were entered on pyth-luma.com, immediate action is required: transfer assets to a new wallet, revoke any connected dApp permissions, and monitor for unauthorized transactions. Network-level protections, such as DNS filtering or endpoint detection rules, should be configured to block domains resolving to 104.21.80.229 or associated with the registrar NICENIC INTERNATIONAL GROUP CO., LIMITED. Security teams should treat domains with similar characteristics—recent registration, Cloudflare obfuscation, and cryptocurrency-themed phishing—as high-priority threats for investigation and blocking.