instantpayfinances[.]world

instantpayfinances.world was observed to host a site titled “Instant Pay Finances” that claims to be associated with Facebook. The domain was registered on 21 February 2026 and is currently taken offline, as indicated by the status flag. DNS resolution points to the IPv4 address 192.3.190.186, which belongs to the HostPapa hosting provider (ASN 36352) located in the United States. The SSL/TLS certificate presented for the site is identified as “R11”, confirming that encrypted HTTPS was configured before the takedown.

The page title and the listed scam type “Social Media Phishing” together suggest that the infrastructure was intended to harvest Facebook credentials by masquerading as a legitimate financial service. VirusTotal scans show that nine out of ninety‑five security vendors flagged the domain, indicating a moderate level of detection across the community. Additionally, the domain appears on at least one public blocklist and has been actively blocked by the PhishDestroy service, reinforcing the assessment that it was used for malicious impersonation.

The evidence does not reveal the specific phishing kit or any further payload details, and no content from the landing page has been captured. Consequently, threat analysts should continue to monitor the IP address 192.3.190.186 for any re‑use, enforce blocklist entries in network defenses, and add the domain to internal phishing watchlists. Defenders are advised to treat any future resolution of this domain or related sub‑domains as high‑confidence indicators of Facebook‑related credential‑stealing activity, and to educate users about unsolicited financial‑service messages that request Facebook login information.