earnlive[.]sbs

This domain, earnlive.sbs, is identified as a credential harvesting phishing site designed to deceive users into submitting sensitive login credentials. Analysis indicates the site mimics legitimate login portals, likely targeting users through deceptive emails or messages that redirect to this fraudulent endpoint. The page title 'Inicio' suggests a focus on Spanish-speaking users, potentially impersonating financial institutions, social media platforms, or other services requiring authentication. Infrastructure analysis reveals the domain was registered on February 06, 2026, through a hosting provider, an unusually future-dated creation that may indicate an attempt to evade detection or establish long-term malicious infrastructure. The domain resolves to the IP address 198.251.84.200 and is flagged by 6 out of 95 security vendors on VirusTotal, indicating moderate but consistent detection across threat intelligence platforms. It appears on 2 security blocklists and is referenced in 2 AlienVault OTX threat intelligence pulses, further corroborating its malicious nature. The SSL certificate is issued by Let's Encrypt, a common tactic to lend false legitimacy to phishing sites. Users who visited earnlive.sbs should immediately revoke any credentials entered on the site, particularly if reused across other platforms. Monitor accounts associated with the submitted credentials for unauthorized activity, such as logins from unfamiliar locations or devices. If financial information was disclosed, contact the relevant institution to report potential fraud. Additionally, scan local devices for malware, as phishing sites may deploy secondary payloads or redirect to exploit kits. Organizations should block the domain and its associated IP (198.251.84.200) at the perimeter to prevent further access. Report the incident to internal security teams or relevant authorities to aid in tracking and mitigating the threat.