pinetworkpibrowser[.]com

The domain pinetworkpibrowser.com was observed hosting a brand‑impersonation campaign that targets Binance users. The site’s HTML title reports “Pi network”, which does not correspond to the advertised brand, indicating a possible attempt to lure victims through unrelated terminology. The domain was created on 17 August 2025 and is registered via Atak Domain, using the Nigerian nameservers ns1.elitebytehosting.com.ng and ns2.elitebytehosting.com.ng. DNS resolution points to the IP address 198.23.141.202, which belongs to the HostPapa hosting provider (ASN 36352) and is geolocated in the United States.

No TLS certificate is presented, leaving the site accessible only over HTTP, which further reduces user trust. A Gridinsoft trust score of 0 out of 100 was recorded, and the domain appears on a single security blocklist. VirusTotal analysis shows that one of ninety‑five scanning engines flagged the domain, confirming at least one detection of malicious behavior. The site has been taken offline and is currently listed as blocked by PhishDestroy.

Evidence indicates that the infrastructure is modest, relying on a shared hosting environment without SSL and with minimal detection avoidance. However, the limited visibility of the page content prevents a full assessment of the phishing vector, such as whether credential‑stealing forms are present. Defenders should continue to monitor the IP address for any re‑use, enforce blocklisting of the domain in corporate web filters, and consider adding the associated nameservers to threat‑intel feeds. Given the confirmed brand‑impersonation intent and the presence of a detection flag, the domain should be treated as high‑risk until further analysis confirms remediation.