exchangepi[.]org

The domain exchangepi.org was registered through Web4Africa Inc. on February 27, 2025 and currently shows an offline status after being taken down. DNS resolution points to the IP address 64.29.17.1, which is hosted in the United States and belongs to ASN 16509 (Amazon.com, Inc.). The domain uses Vercel‑provided nameservers ns1.vercel-dns.com and ns2.vercel-dns.com, and it does not present an SSL/TLS certificate, a notable omission for a site that claims to be a blockchain platform.

The page title returned from the site, "Pi Blockchain, Community & Developer Platform | Pi Network," suggests the content was tied to the Pi Network project, yet the threat profile lists the domain as impersonating Facebook, indicating a brand‑impersonation vector aimed at Facebook users with a crypto‑related lure. Security telemetry shows the domain appears on one blocklist, carries a Gridinsoft trust score of 0 out of 100, and has been blocked by PhishDestroy. VirusTotal analysis recorded four detections out of ninety‑five scanned engines, reinforcing the malicious assessment.

The available intelligence does not disclose the exact page layout, credential‑harvesting mechanisms, or any payload delivery details, leaving the precise operational tactics uncertain. Defensive recommendations include adding exchangepi.org and its hosting IP 64.29.17.1 to network deny lists, monitoring for newly registered domains that reference Pi Network or use Vercel DNS while targeting Facebook branding, and maintaining vigilance for similar patterns in upcoming threat feeds. Continuous correlation with blocklist updates and vendor detections will aid in early identification of successor campaigns.