earnahigherreturn[.]us

Analysis of earnahigherreturn.us indicates that the domain is being used for a high‑risk generic phishing campaign that masquerades as an investment offering. The domain was registered on February 21, 2026 through GoDaddy.com, LLC and resolves to IP address 151.236.216.85, which is owned by AS63949 Akamai Connected Cloud and geolocated in Great Britain. The site presented an HTTP 200 response and served a page titled "Donate | Oxfam International," suggesting an attempt to lure victims by referencing a well‑known charitable organization. The server technology identified is Apache HTTP Server, and the site was protected by a Let’s Encrypt R12 TLS certificate.

Nameserver configuration points to ns.inmotionhosting.com and ns2.inmotionhosting.com, while the MX record is set to the domain itself. Security telemetry shows that 15 of 95 VirusTotal scanners flagged the domain as malicious, Google Safe Browsing classifies it as social engineering, and it is listed on a single security blocklist. The Gridinsoft trust score is 0 out of 100, reinforcing the malicious assessment, and PhishDestroy has already taken the domain offline.

Defenders should block traffic to 151.236.216.85 and to the domain earnahigherreturn.us at DNS and network layers, update threat intelligence feeds with the associated indicators, and monitor for any reuse of the infrastructure. Because the site is currently offline, any residual phishing emails or lures may still be in circulation; therefore, email security solutions should be tuned to flag this domain and its associated URL patterns. Continuous re‑evaluation is advised to detect any re‑hosting attempts or related domains that may emerge from the same registrar or hosting provider.