active-exchange[.]pro

The domain active-exchange.pro has been identified as part of a brand_impersonation campaign targeting Facebook users. Analysis confirms the domain was designed to mimic legitimate Facebook login portals, though its page title misleadingly references Pi Network – Pi Blockchain, Community & Developer Platform | Pi Network. As of the latest assessment, the domain has been taken offline, though prior activity suggests credential harvesting as the primary objective. Infrastructure analysis reveals the domain resolved to the IP address 185.255.122.94, hosted under AS30860 (Virtual Systems LLC) in Ukraine. The domain was flagged by 11 of 95 security vendors on VirusTotal, indicating moderate detection coverage. No SSL certificate was present, a common red flag for fraudulent sites. The domain appears on one security blocklist, further corroborating its malicious classification. Registrar details remain undisclosed, but the combination of impersonation tactics, lack of encryption, and geolocation in a high-risk hosting jurisdiction aligns with known phishing infrastructure patterns. Current status indicates the domain is offline, though residual risk persists for users who may have interacted with it prior to takedown. Organizations are advised to block the domain and associated IP (185.255.122.94) at the network perimeter. Users should be alerted to verify domain authenticity before entering credentials, particularly for social media platforms. Monitoring for similar impersonation domains under the same AS or IP range is recommended to preempt future campaigns.