tradingpicore[.]com

Analysis of tradingpicore.com indicates a confirmed Facebook brand impersonation phishing domain, registered on June 03, 2025, through registrar Cosmotown, Inc. The domain resolves to IP address 198.12.80.250, hosted on AS36352 (HostPapa) in the United States. Infrastructure review reveals nameservers pi1.sammiehost.com and pi2.sammiehost.com, and an SSL certificate issued by Let's Encrypt (R13). The site employs LiteSpeed web server technology and supports HTTP/3, which may aid in evading basic network-based detection mechanisms. The page title, 'Pi Blockchain, Community & Developer Platform | Pi Network,' does not align with the targeted brand (Facebook), suggesting either an attempt to mislead users or a repurposed phishing template.

As of the report date, the domain appears on one security blocklist (PhishDestroy) and is flagged by 16 of 95 security vendors in VirusTotal, reinforcing its classification as malicious. Gridinsoft assigns a trust score of 0/100, further corroborating its high-risk status. No evidence confirms the exact phishing kit or lure mechanism in use, though the scam type is classified as social media phishing. The domain was taken offline prior to July 23, 2026, limiting further live analysis.

Defenders should treat this domain as a confirmed threat vector for Facebook credential theft and block it at DNS, proxy, and endpoint layers. Historical logs should be reviewed for connections to 198.12.80.250 or interactions with the domain to identify potential compromised accounts. Additional monitoring of associated infrastructure (nameservers, hosting provider) is recommended to detect resurgence or related campaigns.