upmarketing[.]pk[.]monopolymarketing[.]pk

Analysis of the domain upmarketing.pk.monopolymarketing.pk indicates a high-risk phishing infrastructure targeting Facebook users. The domain, registered on February 21, 2026, through Worldhost.group, resolves to IP address 192.250.227.80, hosted by WHG Hosting Services Ltd (AS36454) in the United States. The SSL certificate is issued by Let's Encrypt (R12), a common choice for both legitimate and malicious sites, offering no inherent trust signal. The domain is currently active, returning an HTTP 403 status, which may suggest restricted access or a staging phase for the phishing kit. Security vendors have flagged this domain, with 14 of 93 engines on VirusTotal detecting malicious activity.

It appears on three security blocklists, including PhishDestroy, MetaMask, and SEAL, reinforcing its classification as a phishing threat. The page title, 'Up Marketing,' does not explicitly reveal the phishing target, but the domain is explicitly linked to Facebook impersonation in threat intelligence sources. Gridinsoft assigns a trust score of 0/100, further corroborating its malicious nature. The scam type is classified as banking phishing, though the exact mechanics—such as credential harvesting or financial fraud—remain unconfirmed without deeper content analysis. Infrastructure analysis reveals the use of LiteSpeed and HTTP/3, technologies that are not inherently malicious but are frequently employed in high-performance phishing campaigns.

Nameservers ns1.mysecurecloudhost.com and ns2.mysecurecloudhost.com are consistent with the hosting provider's configuration. Defenders should treat this domain as a confirmed threat, blocking it at the DNS and network levels. Organizations targeting Facebook users or operating in regions where this domain may be distributed should prioritize monitoring for connections to 192.250.227.80 and associated indicators.