pi-main[.]com

Analysis of the domain pi-main.com, observed as offline on the reporting date of July 24, 2026, indicates that it was registered through Web4Africa Inc. and created on February 27, 2025. The site is listed as a Facebook impersonation campaign and is classified as a crypto‑scam, likely leveraging the popularity of the Pi Network as suggested by the page title "Pi Blockchain, Community & Developer Platform | Pi Network." Network telemetry shows the domain resolves to the IP address 216.198.79.1, which belongs to Amazon.com, Inc. (AS16509) and is geolocated in the United States. No SSL certificate is presented, meaning the site operates without HTTPS encryption. The infrastructure uses Vercel DNS resolvers (ns1.vercel-dns.com and ns2.vercel-dns.com), a common choice for fast‑changing malicious sites.

Reputation scoring is extremely low, with Gridinsoft assigning a trust score of 0 out of 100. VirusTotal records indicate that six of ninety‑five scanned security vendors flagged the domain, providing additional confirmation of malicious intent. The domain appears on a single security blocklist and has been actively blocked by the PhishDestroy service.

While the exact content of the landing page has not been captured, the combination of brand impersonation, crypto‑scam labeling, and the low trust score strongly suggest a phishing or credential‑harvesting operation targeting Facebook users. Defenders should update web filtering and DNS blocking policies to include pi-main.com and its resolved IP 216.198.79.1, monitor for any re‑activation of the domain, and consider adding the associated nameservers to threat‑intel watchlists. Because the site currently reports as offline, continuous observation is advised to detect any future resurrection or related infrastructure changes.