getpipayment[.]com

This domain, getpipayment.com, is identified as a credential theft operation targeting users of the Pi Network blockchain platform. Analysis indicates the site mimics the legitimate Pi Network portal, using identical page titles and branding elements to deceive visitors into submitting wallet credentials or personal login details. No direct evidence of a crypto drainer kit was observed, but the infrastructure aligns with credential harvesting campaigns designed to compromise cryptocurrency wallets or accounts. Infrastructure analysis reveals the domain was registered on March 20, 2025, through TuringSign Inc. d/b/a Cosmotown, resolving to the IP address 198.12.80.250, hosted on AS36352 (HostPapa, US). VirusTotal reports 10 out of 95 security vendors flagging the domain as malicious, while it appears on a single security blocklist. The SSL certificate is classified as R11, a common indicator for low-reputation or short-lived certificates. No Google Safe Browsing (GSB) detections were recorded at the time of analysis. The domain is currently offline, reducing immediate exposure risk, though historical data suggests potential for reactivation or migration to new infrastructure. Users who accessed the site prior to takedown should assume credential exposure and take immediate remediation steps: revoke active sessions, reset passwords, enable multi-factor authentication, and monitor linked accounts for unauthorized transactions. The elevated risk level persists due to the domain's recent creation, targeted impersonation of a cryptocurrency platform, and partial vendor detection coverage.