minepiranking[.]pro

Analysis of the domain minepiranking.pro shows a short-lived banking phishing infrastructure that has been taken offline as of the report date. The domain resolves to the IPv4 address 3.125.172.46, which belongs to Amazon.com, Inc. (AS16509) and is geolocated in Germany. Hosting on Amazon's cloud platform is common for disposable phishing sites, offering rapid provisioning and easy termination. Nameserver resolution points to dns1.nominalia.com and dns2.nominalia.com, and the MX record is configured to mail.nominalia.com with priority 10, indicating the registrar’s default mail routing rather than a custom exfiltration endpoint.

No TLS certificate is presented for the site, leaving HTTP traffic unencrypted and exposing any credentials submitted to the page. The only visible web‑page attribute is the title "Mine Pi Ranking," which does not correspond to a legitimate brand and provides no further clues about the targeted victim base. The domain was flagged by PhishDestroy and appears on a single public blocklist, suggesting limited detection and rapid takedown. VirusTotal scans recorded 2 detections out of 95 security vendors, confirming that at least some scanners identified malicious behavior.

Registration was performed through Register SPA, a registrar that does not apply strict identity verification, facilitating anonymous abuse. Defenders should immediately block the domain and its associated IP address at perimeter defenses, enforce HTTPS inspection to detect any future attempts to serve similar content, and monitor for other domains that resolve to the same Amazon IP range. Continued observation of the registrar’s name server patterns may reveal additional disposable domains created in parallel.