exchangecore[.]za[.]com

Analysis of exchangecore.za.com indicates that the domain resolves to the IPv4 address 185.255.122.94, which is announced by AS30860 Virtual Systems LLC and geolocated to Ukraine. The domain is hosted on nameservers ns1.freednsdedi.com and ns2.freednsdedi.com and does not present an SSL/TLS certificate, exposing any HTTP traffic to interception. VirusTotal records show that six of ninety‑five scanned security vendors have flagged the domain, suggesting malicious intent, while the Gridinsoft trust score registers a zero out of one hundred, reinforcing the suspicion of abuse.

The site’s page title, "Pi Network – Pi Blockchain, Community & Developer Platform | Pi Network," references a cryptocurrency project, aligning with the classification of a crypto scam, yet the brand target listed is Facebook, indicating an attempt to impersonate that social platform. The domain appears on a single external security blocklist and has been explicitly blocked by the PhishDestroy service, confirming that at least one downstream security provider has taken mitigation action. Current status is offline, limiting direct observation of the payload or user‑facing content; consequently, the exact nature of the impersonation (e.g., login capture, credential harvesting, or malicious redirects) remains unverified.

Defenders should continue to block the domain and its associated IP at perimeter defenses, incorporate the domain and IP into threat‑intel feeds, and monitor for re‑registration or similar naming patterns. Further investigation should be conducted if the domain returns online, focusing on HTTP response bodies, JavaScript behavior, and any credential‑collection mechanisms that may be tied to the Facebook brand claim.