pyth-board[.]vercel[.]app

This domain is flagged as a high-risk brand impersonation threat, specifically targeting Twitter’s Pyth Network branding. Analysis indicates the site mimics the Pyth Network Staking Dashboard, a tactic commonly used to deceive users into disclosing sensitive credentials or financial information under false pretenses. The threat type aligns with credential harvesting and fraudulent asset transfer schemes, leveraging trusted brand recognition to lower user defenses. Infrastructure analysis reveals multiple concrete indicators of malicious activity. The domain pyth-board.vercel.app is registered through Vercel Inc. and resolves to the IP address 64.29.17.131, hosted on Amazon.com, Inc.’s AS16509 network in the United States. The SSL certificate is issued by Google Trust Services (WR1), a common feature in both legitimate and malicious sites. VirusTotal reports 15 out of 95 security vendors flagging the domain as malicious, while Google Safe Browsing explicitly classifies it as phishing. The domain appears on three security blocklists and is actively blocked by PhishDestroy, MetaMask, and SEAL, further corroborating its fraudulent nature. Despite these warnings, the site remains operational as of the latest assessment. Mitigation steps for this specific threat type include immediate blocking of the domain and its associated IP address (64.29.17.131) at the network perimeter. Organizations should update endpoint protection rules to detect and prevent access to the domain, particularly for users interacting with cryptocurrency or financial platforms. Security teams are advised to monitor for phishing emails or social engineering attempts directing users to pyth-board.vercel.app, as these are likely vectors for the campaign. User awareness training should emphasize the risks of brand impersonation, particularly for platforms involving staking dashboards or financial transactions. Additionally, domain registrars and hosting providers should be notified of the abuse to facilitate takedown procedures, given the domain’s active status and high-risk classification.