exchangepaygo[.]com

On July 22, 2026, analysis of exchangepaygo.com shows that the domain was registered on April 23, 2025 through Cosmotown, Inc. The authoritative name server count is reported as one, and the domain resolves to the IPv4 address 198.12.80.250, which belongs to AS36352 operated by HostPapa in the United States. No TLS certificate was observed, indicating that the site was served over plain HTTP at the time of collection. The page title returned by the HTTP response is "Pi Blockchain, Community & Developer Platform | Pi Network", which aligns with the listed scam type of a crypto‑related scheme. The domain is flagged as a Facebook impersonation, suggesting that any luring content would reference the Facebook brand, although the exact landing page content has not been captured.

VirusTotal scans identified the domain as malicious in six out of ninety‑five vendor engines, and the domain appears on a single external security blocklist. PhishDestroy also listed the domain as blocked, reinforcing the malicious classification. Gridinsoft assigned a trust score of 0 out of 100, reflecting a lack of confidence in the host. The overall risk rating is elevated, and the infrastructure status is currently offline, indicating that the site has been taken down or is otherwise inaccessible.

While the available data confirms the registration details, hosting provider, IP location, lack of SSL, and the presence of multiple detection signals, the specific phishing kit, payload, or user‑facing artifacts remain unknown because the site was not captured while active. Analysts should continue to monitor the IP address 198.12.80.250 for any re‑use in future campaigns, and add exchangepaygo.com to internal blocklists and DNS sinkhole configurations. Defensive teams should also enforce strict outbound filtering for traffic to the identified IP range and educate users about unsolicited messages that claim to originate from Facebook but redirect to unrelated cryptocurrency content.