enter-pyth[.]xyz

Analysis of enter-pyth.xyz, created on February 27, 2026 and currently taken offline, indicates that the domain was used in a generic phishing campaign. The site resolved to IP address 172.67.147.213, which is owned by Cloudflare, Inc. (AS13335) and geolocated to the United States. DNS resolution was provided by the Cloudflare nameservers sima.ns.cloudflare.com and tate.ns.cloudflare.com, confirming the use of Cloudflare’s edge network and HTTP/3 support. The TLS certificate presented was issued by Google Trust Services under the WE1 intermediate, a standard certificate chain for Cloudflare‑protected sites, suggesting that the HTTPS connection was properly encrypted despite the malicious intent.

VirusTotal recorded detections from 2 of 93 scanning vendors, and the domain appears on three external security blocklists, where it has been listed by PhishDestroy, MetaMask, and SEAL. An HTTP request returned a 404 status code, indicating that the landing page is no longer accessible. The only visible page metadata is the title "The Price Layer for Global Finance | Pyth Network," which aligns with the targeting of the Pyth Network brand, though the content of the page has not been captured for further analysis.

From a defensive perspective, the presence of Cloudflare as a fronting service complicates attribution of the underlying server, but the combination of a recent registration date, low‑volume vendor detections, and inclusion on multiple blocklists suggests a deliberate, short‑lived phishing operation. Security teams should add explicit deny rules for the domain and its associated IP range, monitor for any future DNS resolution changes, and consider broader threat‑intel correlation with other domains using the same Cloudflare nameservers or similar Pyth‑related page titles. Continuous observation of the registrar Dynadot LLC for new registrations that mimic this pattern is also recommended, as threat actors frequently recycle registrars to evade detection.