bulkpi[.]freeclaim-net[.]com

This domain, www.bulkpi.freeclaim-net.com, was registered on 21 February 2026 through Dynadot LLC and is currently listed as offline. DNS resolution points to the IPv4 address 161.97.121.66, which belongs to Contabo GmbH in France and is announced by ASN 51167. The authoritative nameservers are ns1.serverdns.org and ns2.serverdns.org, and the site presented a valid Let’s Encrypt TLS certificate (R12) at the time of capture. The only visible content is the page title “Claim Your Pi Coins – Pi Network”, indicating an attempt to lure victims into a crypto‑draining scheme targeting users of the Pi Network.

Security telemetry shows the domain appears on one external blocklist and has been actively blocked by the PhishDestroy service. VirusTotal analysis recorded four positive detections out of 93 scanning engines, reinforcing the malicious classification. The observed scam type is recorded as a crypto scam, consistent with the page title and the broader threat landscape of cryptocurrency drainers. While the site is offline, the infrastructure components—registrar, hosting provider, IP address, and SSL certificate—remain reusable for future campaigns.

No additional artifacts such as payload hashes, command‑and‑control endpoints, or victim reports have been published, leaving the full operational scope uncertain. Defenders should add the domain and its resolving IP to network‑level deny lists, enforce DNS filtering for the associated nameservers, and monitor Contabo‑hosted address space for similar activity. Continuous re‑scanning of the domain and periodic queries of blocklist feeds are recommended to detect any re‑deployment. Updating intrusion‑detection signatures to flag the “Claim Your Pi Coins – Pi Network” title can further reduce exposure to this specific crypto drainer vector.