pi-activating[.]com

This domain, pi-activating.com, operates as a credential-harvesting phishing portal impersonating the legitimate Pi Network blockchain platform. Analysis indicates the site specifically targets cryptocurrency users by presenting a fraudulent login interface that mimics the authentic Pi Network developer and community portal. The page title, 'Pi Blockchain, Community & Developer Platform | Pi Network,' directly replicates the branding of the genuine platform, increasing the likelihood of successful deception among users seeking to access Pi Network services or participate in its ecosystem. The infrastructure is designed to capture sensitive authentication details, including usernames, passwords, and potentially multi-factor authentication codes, which could lead to unauthorized access to victims' cryptocurrency wallets or associated accounts. Infrastructure analysis reveals multiple technical indicators supporting the phishing classification. The domain was registered on April 15, 2025, through Cosmotown, Inc., and resolves to the IP address 198.12.80.250, hosted on AS36352 (HostPapa) in the United States. The site employs a Let's Encrypt SSL certificate (R13), a common tactic among phishing operators to create a false sense of security. As of the latest assessment, pi-activating.com appears on one security blocklist and is flagged by 9 out of 95 security vendors on VirusTotal, including detections for generic phishing and credential theft. The domain was proactively blocked by PhishDestroy and is currently offline, though historical activity suggests it may have been operational for a limited period to maximize victim engagement. Users who visited pi-activating.com or entered credentials on the site should take immediate remedial action. First, revoke any active sessions and change passwords for Pi Network accounts and any other platforms where identical or similar credentials were used. Enable multi-factor authentication (MFA) if not already active, using app-based or hardware tokens rather than SMS-based methods. Monitor associated cryptocurrency wallets and financial accounts for unauthorized transactions, and report any suspicious activity to the relevant platform's security team. Given the domain's recent creation and targeted nature, affected users should also consider scanning their devices for malware, as phishing sites occasionally deploy additional payloads to maintain persistence or exfiltrate further data. If personal or financial information was disclosed, users are advised to follow standard incident response protocols, including notifying relevant financial institutions and credit monitoring services.