pinet-2fa[.]online

Analysis of the domain pinet-2fa.online indicates it was actively used in a phishing campaign targeting users of the Pi Network platform, as evidenced by the page title 'Pi Network Security Authentication - Home.' The domain was registered on March 12, 2026, through Go Daddy, LLC, and resolved to the IP address 185.199.109.153, which is associated with AS54113 (Fastly, Inc.) in the United States. The domain's nameservers, ns53.domaincontrol.com and ns54.domaincontrol.com, further link it to Go Daddy's infrastructure. At the time of assessment, the domain was flagged by one security blocklist, PhishDestroy, and three out of 94 security vendors on VirusTotal identified it as malicious, suggesting limited but confirmed detection. Infrastructure analysis reveals the use of Varnish, GitHub Pages, and Fastly technologies, which are commonly employed for legitimate web hosting but are also leveraged in phishing operations for their scalability and low cost.

The SSL certificate, issued by Let's Encrypt (R12), does not provide additional trust indicators, as such certificates are freely available and frequently used in both legitimate and malicious contexts. The domain's current status is offline, which may indicate takedown action or voluntary suspension by the threat actor. Defenders should treat this domain as a confirmed phishing threat targeting Pi Network users, likely designed to harvest two-factor authentication (2FA) credentials or other sensitive account information. The limited detection count on VirusTotal does not diminish the risk, as phishing domains often evade initial detection.

Network-level blocking of the IP 185.199.109.153 and the domain itself is recommended for organizations with exposure to Pi Network or similar cryptocurrency platforms. Monitoring for related domains registered through Go Daddy or utilizing Fastly's infrastructure may help identify additional threats.