pi-marketpayment[.]com

The domain pi-marketpayment.com was registered on May 25, 2025 through Cosmotown, Inc. and resolves to the IP address 198.12.80.250, which belongs to AS36352 hosted by HostPapa in the United States. The site presents a TLS certificate issued by Let’s Encrypt (R12) and operates over LiteSpeed web server with HTTP/3 support. Analysis of the page title returned by the site – “Pi Blockchain, Community & Developer Platform | Pi Network” – suggests an attempt to associate the domain with the legitimate Pi Network brand, yet the domain itself is unrelated to the official Pi Network infrastructure.

The domain is currently offline, but historical data show it was flagged by multiple security services: it appears on one security blocklist, is blocked by PhishDestroy, and 14 of 95 VirusTotal scanners reported it as malicious. Gridinsoft assigned a trust score of 0 out of 100, indicating a high likelihood of abuse. The recorded scam type is a crypto scam, aligning with the observed use of the Pi branding to lure victims.

While the exact content of the site beyond the title has not been captured, the combination of a low trust score, multiple vendor detections, and blocklist inclusion provides strong evidence of malicious intent. Defenders should add pi-marketpayment.com to deny‑list rules, monitor its IP range for related activity, and ensure that any traffic to the domain is blocked at the perimeter. Continuous re‑evaluation is recommended in case the domain returns online or is reused in future campaigns.