pythaoi[.]com

Analysis indicates that the domain pythaoi.com was registered on February 21, 2026 and is currently hosted behind Cloudflare (AS13335) with the IP address 104.21.46.72 located in the United States. The site presented an SSL certificate identified as WE1, suggesting a publicly trusted TLS certificate. Threat intelligence records label the infrastructure as a generic phishing operation and the domain has been taken offline, with PhishDestroy confirming the takedown. Reputation data shows a Gridinsoft trust score of 0 out of 100 and the domain appears on a single security blocklist.

VirusTotal scans have returned 11 positive detections out of 93 scanning engines, reinforcing the malicious classification. The combined evidence from certificate, hosting, detection vendors, and blocklist presence supports an elevated risk rating. Defenders should continue to block any outbound connections to 104.21.46.72, add pythaoi.com to DNS filtering policies, and monitor for any re‑registration or use of similar domains.

Because the site is offline, active payload analysis is not possible; however, the presence of a valid TLS certificate and the Cloudflare front‑end are typical of phishing actors that use reputable CDN services to obscure origin. Organizations should also verify that internal users have not previously accessed the domain and, if they have, review credential exposure and enforce password resets. Ongoing monitoring of the ASN, blocklist status, and future VirusTotal submissions is recommended to detect potential re‑emergence.