kycpinetwork[.]com

Analysis of kycpinetwork.com shows a confirmed crypto‑related phishing operation that has been taken offline as of the report date. The site presented the page title “KYC Pi Network | Pi Blockchain, Community & Developer Platform | Pi Network,” indicating an attempt to impersonate the Pi Network KYC process. Technical fingerprints reveal the web server runs Nginx with OpenResty, and the TLS certificate is issued by GoDaddy Secure Certificate Authority – G2, consistent with the registrar GoDaddy.com, LLC. The domain resolves to the Amazon‑owned IP 75.2.60.5 (AS16509, United States) and uses GoDaddy’s default nameservers ns15.domaincontrol.com and ns16.domaincontrol.com.

VirusTotal records show that one out of ninety‑five scanning engines flagged the domain, and it appears on a single external security blocklist, where PhishDestroy has already blocked it. The Gridinsoft trust score of 0 / 100 further corroborates its malicious nature. Registration data indicates the domain was created on 13 February 2025, a relatively recent creation consistent with fast‑flux or opportunistic phishing campaigns.

While the site is currently offline, defenders should still treat the associated IP and certificate as hostile. Recommended actions include adding 75.2.60.5 to network deny lists, monitoring DNS queries for the domain and its nameservers, and enforcing email filtering rules that block any communications referencing the Pi Network KYC process from untrusted origins. Continuous vigilance for newly registered look‑alike domains using similar “kyc” or “pi network” keywords is advised, as threat actors often recycle infrastructure after takedown.