upearn[.]demotunde[.]com

The domain www.upearn.demotunde.com is currently active and classified as a high‑risk generic phishing infrastructure. Registration records show the domain was created on March 05, 2026 and was purchased through Spaceship, Inc. The authoritative name servers listed are ns5.maskhosting.com and ns6.maskhosting.com, indicating reliance on the maskhosting.com hosting platform. DNS resolution points the domain to the IPv4 address 5.182.208.207. This IP address has been observed on a single security blocklist and the domain is explicitly blocked by the PhishDestroy blocklist service.

VirusTotal analysis reports that 2 of 91 security vendors have flagged the domain as malicious, providing independent confirmation of its suspicious nature. The combination of recent creation, dedicated hosting, blocklist presence, and vendor detections suggests an intentionally deployed phishing operation rather than an incidental or compromised legitimate site. While the available intelligence does not include details such as SSL certificate status, HTTP response codes, or page content, the existing evidence is sufficient for defensive teams to take immediate mitigation actions.

Organizations should add the domain and its resolving IP address (5.182.208.207) to deny‑list rules in firewalls, DNS filters, and endpoint protection solutions. Continuous monitoring of the associated IP and name server infrastructure is advised, as threat actors often shift hosting or reuse components. Given the high risk rating and active status, blocking the domain at the network perimeter and informing users of the malicious URL are recommended to reduce exposure to credential harvesting attempts.