pinetworkexchange[.]cfd

Analysis of pinetworkexchange.cfd indicates an active brand impersonation campaign targeting Facebook users with a cryptocurrency‑related scam. The domain was registered on January 07, 2025 through Dynadot LLC and is hosted on an IPv6 address (2a02:4780:b:1109:0:2f60:8e67:10) belonging to AS47583, Hostinger International Limited, located in the United States. The hosting environment uses generic parking name servers (ns1.dns-parking.com, ns2.dns-parking.com) and lacks an SSL/TLS certificate, suggesting minimal effort to establish credibility beyond the domain name itself.

The page title returned by the server reads "Pi Network – Pi Blockchain, Community & Developer Platform | Pi Network," which aligns with the declared scam type of a crypto scheme and may be intended to lure victims familiar with legitimate blockchain projects. VirusTotal scans show that one of ninety‑five security vendors flagged the domain, and the site is listed on a single external security blocklist. PhishDestroy has also taken action to block the domain, and the current operational status is offline, indicating that the site may have been taken down or is temporarily unavailable.

While the observable infrastructure confirms a deliberate attempt to masquerade as a Facebook‑related service, the exact content and credential‑ harvesting mechanisms have not been captured in the available data. Defenders should continue to block the IPv6 address and associated name servers, add pinetworkexchange.cfd to internal URL filtering lists, and monitor for any re‑use of the domain or similar aliases. Ongoing observation of Hostinger‑hosted crypto‑related domains is advised, as the infrastructure pattern—parking name servers, lack of TLS, and minimal detection footprints—matches known low‑cost phishing deployments.