getpaymentoption[.]com

Analysis indicates that getpaymentoption.com was registered on 21 February 2026 and is currently taken offline. The domain resolves to IP 198.12.80.250, which is allocated to HostPapa in the United States under ASN 36352. The hosting infrastructure suggests a shared hosting environment often abused for malicious campaigns. The site presented a page title referencing “Pi Blockchain, Community & Developer Platform | Pi Network,” aligning with the reported crypto‑scam classification. No additional page content has been captured, so the exact malicious payload or credential‑harvesting mechanisms remain unknown.

Security‑vendor scans on VirusTotal show 12 of 95 scanners flagging the domain, confirming a consensus of malicious behavior. Gridinsoft assigns a trust score of 0 out of 100, and the domain appears on a single external blocklist. PhishDestroy has also listed the domain as blocked. The SSL certificate is rated R10, indicating a low‑trust certificate that further reduces confidence in the site’s legitimacy. Defenders should treat getpaymentoption.com as a high‑confidence indicator of a crypto‑related phishing operation targeting users of the Pi Network.

Immediate mitigation actions include adding the domain and its resolving IP address to outbound and inbound filtering rules, updating local DNS blocklists, and ensuring that any threat‑intel feeds that reference the domain are subscribed. Continuous monitoring for re‑registration or resurrection of the domain is advised, as threat actors often recycle infrastructure. Where possible, correlate internal logs for any prior connections to 198.12.80.250 or attempts to access the domain, and investigate related user reports for potential credential compromise. The limited public visibility of the payload means that investigators should prioritize network‑level containment while awaiting further forensic evidence.