pi-network-payment[.]com

This domain is flagged as a generic phishing threat with an elevated risk level, specifically targeting users of the Pi Network cryptocurrency platform. The site masquerades as an official payment activation portal, a common tactic in credential harvesting and financial fraud campaigns. Analysis indicates the domain pi-network-payment.com was registered on February 21, 2026, through Cosmotown, Inc., a registrar frequently associated with low-reputation domains. It resolves to the IP address 173.0.59.106, hosted on AS27323 (Wowrack.com) in the United States. The domain is currently offline but was previously detected by 17 out of 95 security vendors on VirusTotal, with one active security blocklist entry. The SSL certificate is issued by Let's Encrypt (R13), a common choice for both legitimate and malicious sites due to its free and automated nature. The page title, 'Pi Network - Activate Payment Options,' aligns with phishing lures designed to exploit user trust in cryptocurrency-related services. To mitigate risks associated with this phishing domain, network defenders should block the domain and its resolving IP (173.0.59.106) at the perimeter. Endpoint protection systems should be updated to include this domain in phishing and malicious URL databases. Users who may have interacted with the site should be advised to reset credentials for any accounts linked to Pi Network or cryptocurrency services, enable multi-factor authentication, and monitor financial transactions for unauthorized activity. Security teams should conduct retrospective analysis to identify any prior connections to the domain or IP within their environments.