unlock-pi[.]site

Analysis of unlock-pi.site indicates that the domain is currently active and has been classified as a generic phishing threat with an elevated risk rating. The domain is listed on a single security blocklist and has been explicitly blocked by the PhishDestroy mitigation service. VirusTotal data shows that one out of ninety‑one scanning engines has generated a detection for the domain, suggesting that at least one security vendor has identified malicious characteristics, though the majority of engines have not flagged it.

No additional infrastructure details such as registrar information, IP address, autonomous system number, hosting location, SSL certificate attributes, HTTP response codes, or Safe Browsing status are available in the current intelligence set, leaving the broader attack surface uncharacterized. The lack of observable page title, brand targeting, or kit attribution further limits the ability to attribute the phishing campaign to a specific campaign or actor.

Given the confirmed blocklist presence and the PhishDestroy block, defensive teams should proactively add unlock-pi.site to network and endpoint deny lists, enforce DNS sinkholing where possible, and monitor for any outbound connections to the domain. Continuous re‑evaluation is advised, as additional telemetry such as content analysis, hosting metadata, or further vendor detections could refine the threat profile and inform response measures.