exchange-id[.]com

exchange-id.com is currently offline but was observed resolving to the IPv4 address 198.12.80.250, which is hosted by AS36352 (HostPapa) in the United States. The domain was registered on May 21 2025 through Cosmotown, Inc., and no SSL certificate was presented during the last check, indicating that any content was served over plain HTTP. The sole page title retrieved from the site was “Pi Blockchain, Community & Developer Platform | Pi Network,” which does not align with the claimed impersonation of Facebook and suggests a cryptocurrency‑related lure. The threat profile lists the domain as a brand‑impersonation campaign targeting Facebook and classifies the activity as a crypto scam.

Security telemetry shows that 13 of 95 VirusTotal scanners flagged the domain as malicious, and it appears on a single external blocklist. Gridinsoft assigned a trust score of 0 / 100, while Scamadviser reported a score of 1 / 100, both indicating extreme distrust. The domain has also been blocked by PhishDestroy.

Because the site is taken offline, content analysis is limited, and the exact phishing kit or credential‑harvesting mechanism remains unknown. Defenders should continue to block the domain and its hosting IP, add the domain to internal URL filtering lists, and monitor for any future DNS re‑registration or similar patterns using the same registrar or hosting provider. Additional scrutiny of traffic to 198.12.80.250 is advised, and any attempts to serve Facebook‑related login pages from this infrastructure should be treated as malicious.