activatep2ptrading[.]com[.]activatep2ptrade[.]com

Analysis of activatep2ptrading.com.activatep2ptrade.com indicates a confirmed phishing operation targeting Facebook users, classified as social media phishing. The domain, registered on February 13, 2025, through PDR Ltd. d/b/a PublicDomainRegistry.com, resolved to IP 198.251.89.30 (AS53667 FranTech Solutions, US) and was hosted on nameservers ns23.asurahosting.com and ns24.asurahosting.com. At the time of assessment, the domain was offline, with no SSL certificate detected.

The page title, 'Pi Blockchain, Community & Developer Platform | Pi Network,' does not align with the targeted brand (Facebook), suggesting either misdirection or an attempt to obfuscate the phishing intent. Infrastructure analysis reveals the domain was flagged by one security blocklist (PhishDestroy) and detected by 10 of 95 vendors in VirusTotal scans. The Gridinsoft trust score of 0/100 further supports its malicious classification.

Defenders should treat this domain as a confirmed credential harvesting threat, particularly for Facebook accounts. Recommended actions include blocking the domain and IP at network perimeter controls, updating endpoint detection rules to include the domain and associated infrastructure, and monitoring for related subdomains or IPs within the same ASN (53667). Due to the domain's current offline status, further forensic analysis of the phishing kit or backend infrastructure is not possible, but historical DNS and WHOIS records should be preserved for potential incident response or legal actions.