p2p-trade[.]netlify[.]app

The domain p2p-trade.netlify.app is currently active and has been classified as a high‑risk brand‑impersonation site targeting Facebook. The page title returned by the server reads “Pi Blockchain, Community & Developer Platform | Pi Network,” which does not reference Facebook, indicating the site may be leveraging unrelated content to obscure its malicious intent. The threat type is recorded as social_media, aligning with the impersonation of a major social platform.

Infrastructure analysis shows the site is hosted on Netlify and resolves to the IP address 63.176.8.218, located in Germany and announced by the Amazon.com, Inc. ASN16509. The TLS certificate is issued by DigiCert Global G2, using a SHA‑256 RSA signature, and the server returns HTTP 200 for the root request. Detected technologies include WordPress, MySQL, PHP, YouTube embeds, Yoast SEO (both premium and standard), and Unpkg, suggesting a generic web‑stack rather than a purpose‑built phishing kit.

Reputation data indicates a Gridinsoft trust score of 0 / 100 and that twelve out of ninety‑five VirusTotal scanners flagged the domain as malicious. The domain was registered on 21 February 2026 through Name.com, Inc., and is listed on at least one public phishing blocklist. PhishDestroy has also blocked the domain, reinforcing its classification as an active threat.

Defenders should add p2p-trade.netlify.app to URL filtering rules and block outbound connections to its IP range. Monitoring for similar Netlify‑hosted domains that resolve to the same ASN or share the same technology fingerprint can help surface related campaigns. Incident response teams should treat any user‑initiated traffic to this domain as potentially compromised and enforce credential reset procedures for accounts that may have been exposed.