exchange-activate[.]com

exchange-activate.com was registered on 22 May 2025 through Cosmotown, Inc. The domain resolves to the IPv4 address 198.12.80.250, which belongs to AS36352 (HostPapa) in the United States. No TLS certificate is presented, meaning the site is served over plain HTTP only. The page title observed during the brief crawl is “Pi Blockchain, Community & Developer Platform | Pi Network”, which does not reference the advertised Facebook brand, indicating a mismatch between the claimed impersonation target and the content served. The site is flagged as a crypto‑related scam that pretends to be associated with Facebook, and it has been added to at least one public blocklist and is currently blocked by the PhishDestroy service.

Gridinsoft assigns a trust score of 0 out of 100, reflecting a high confidence of malicious intent. VirusTotal reports that 12 of 95 scanned scanners label the domain as malicious, reinforcing the suspicion. The domain is presently offline, but the underlying infrastructure remains reachable, and the hosting provider (HostPapa) may be used for other malicious campaigns. Defenders should immediately add 198.12.80.250 and exchange-activate.com to network‑level deny lists, enforce URL filtering for the domain, and monitor for any outbound connections to the IP address.

Because the site claims to impersonate Facebook, organizations should remind users that Facebook never requests cryptocurrency payments and that any unsolicited Facebook‑related messages asking for crypto transfers are fraudulent. Threat‑intel teams should continue to watch the registrar Cosmotown, Inc. for future registrations that reuse similar naming patterns, and consider reporting the domain to additional takedown services. Until the site is permanently taken down, the recommendation is to keep the domain blocked and to scrutinize any traffic that attempts to resolve it.