pi-airdrop[.]ct[.]ws

Analysis of pi‑airdrop.ct.ws indicates a high‑risk cryptocurrency drainer operation. The site presents the page title “Pi Network – Get your free pi reward,” which is commonly used in fraudulent campaigns targeting users of the Pi Network project. The domain is currently active and classified as a crypto‑drainer, confirming its intent to lure victims into transferring digital assets.

Infrastructure analysis reveals the site is hosted on a server located in the United Kingdom, identified by IP address 185.27.134.34 belonging to AS34119 Wildcard UK Limited. The domain resolves through the Byet.org name server cluster (ns1.byet.org, ns2.byet.org, ns3.byet.org, ns4.byet.org, ns5.byet.org). The web stack consists of WordPress powered by PHP and MySQL, front‑ended by Nginx/OpenResty and enriched with jQuery, jQuery Migrate, and Font Awesome libraries. SSL is provided by ZeroSSL ECC Domain Secure Site CA, indicating a publicly available free certificate.

Reputation signals show a zero‑point trust rating from Gridinsoft, and five out of ninety‑five VirusTotal scanners have flagged the domain as malicious. The site is listed on a single security blocklist and has been actively blocked by the PhishDestroy service. HTTP requests return a 200 status code, confirming the site is serving content without immediate disruption.

Defenders should prioritize immediate containment by adding pi‑airdrop.ct.ws to network blocklists and DNS filtering rules. Continuous monitoring of the associated IP address and its ASN is advised, as the hosting provider may be leveraged for additional malicious domains. Incident response teams should also audit any inbound traffic that references the “Pi Network” reward phrasing, and consider sinkholing the domain to disrupt the campaign’s infrastructure.