minepi[.]one

This domain is flagged for elevated-risk brand impersonation targeting Revolut users. Analysis indicates the infrastructure was designed to mimic legitimate financial services login portals, specifically aiming to capture authentication credentials or personal financial data. The page title, 'Pi Network,' suggests an attempt to mislead users into believing the site is associated with a cryptocurrency platform, further obscuring its true fraudulent intent. Infrastructure analysis reveals the domain minepi.one was registered on March 4, 2025, through Spaceship, Inc., a registrar with a history of hosting suspicious domains. It resolves to the IP address 172.67.195.211, which has been linked to other low-reputation hosting environments. Detection metrics show minimal coverage, with only 1 out of 95 security vendors flagging the domain on VirusTotal. The domain appears on a single security blocklist, and Gridinsoft assigned it a trust score of 0/100, indicating high confidence in its malicious nature. The domain has since been taken offline, though historical records confirm its use in credential harvesting campaigns. Mitigation steps for organizations and end-users include immediate blocking of the domain minepi.one and its resolving IP 172.67.195.211 at the network perimeter. Financial institutions should monitor for unusual login attempts originating from this infrastructure and alert affected customers. End-users are advised to verify domain authenticity before entering credentials, particularly for financial services, and to enable multi-factor authentication to reduce the impact of credential theft. Security teams should prioritize monitoring for similar domains registered through Spaceship, Inc., or resolving to the same IP range, as these may indicate emerging threats.