pay[.]mainnetbyte[.]com

Analysis of the domain pay.mainnetbyte.com indicates active involvement in a cryptocurrency-themed phishing campaign, as classified by available threat intelligence. The domain was registered on February 21, 2026, through Sav.com, LLC, and currently resolves to the IP address 107.172.61.186, hosted on AS36352 (HostPapa) in the United States. The domain's nameservers, ns1.korrectserver.com and ns2.korrectserver.com, suggest a distinct hosting infrastructure, though no further historical associations with these nameservers are confirmed in the available data. The site returns an HTTP 200 status code and is served over HTTP/3 using LiteSpeed web server technology. The page title, 'Pi Blockchain, Community,' implies an attempt to impersonate or reference a cryptocurrency-related platform, though the exact nature of the deception—whether targeting wallet credentials, private keys, or fraudulent token claims—remains unconfirmed without deeper content analysis. The domain holds a Gridinsoft trust score of 0/100, reinforcing its high-risk classification. It appears on one security blocklist (PhishDestroy) and is flagged by two of 93 security vendors on VirusTotal, though the specific detection logic or signatures are not disclosed in the available intelligence. The SSL certificate is issued by Let's Encrypt (R13), a common choice for both legitimate and malicious domains due to its accessibility. The domain's creation date, five months prior to this report, does not deviate from typical phishing domain lifecycles, which often operate for weeks to months before detection or takedown. Defenders should prioritize blocking the domain and its resolving IP (107.172.61.186) at the network level, while monitoring associated nameservers for additional malicious domains. Further investigation into the hosting provider's abuse response and potential clustering with other cryptocurrency-themed phishing domains is recommended to assess broader campaign infrastructure.