unlockp2ptrade[.]com

unlockp2ptrade.com was observed to be offline as of the report date (July 23, 2026) but historical scans indicate it was used for a Facebook impersonation campaign tied to a crypto‑scam narrative. The domain, registered on March 03, 2025 through Global Domain Group LLC, resolves to the IP address 198.251.89.144, which is announced by AS53667 (FranTech Solutions) and geolocated to the United States. No SSL certificate was presented during the scan, meaning the site operated over plain HTTP. The page title returned by the server was “Pi Blockchain, Community & Developer Platform | Pi Network”, a content label unrelated to Facebook, suggesting the attackers leveraged a popular blockchain name to attract victims.

Infrastructure analysis shows four name servers – ns15.asurahosting.com, ns15.my‑control‑panel.com, ns16.asurahosting.com, and ns16.my‑co – which are typical of low‑cost hosting providers. Reputation data includes a Gridinsoft trust score of 0 out of 100 and a presence on one security blocklist; the domain is also listed as blocked by PhishDestroy. VirusTotal scans recorded 15 detections out of 95 security vendors, confirming that multiple engines recognize the domain as malicious. AlienVault OTX cited the domain in a single threat‑intel pulse, reinforcing its classification as a known malicious indicator.

The combined evidence points to a brand‑impersonation vector that lures victims with a false Facebook association and a cryptocurrency narrative. Defenders should add the domain and its associated IP address to blocklists, monitor for any resurgence, and ensure that any inbound traffic to the listed name servers is denied. Network sensors should be tuned to flag HTTP requests lacking TLS to the domain, and incident response teams should educate users about the mismatch between the Facebook brand and unrelated blockchain content.