earnelgti-cjkfbd[.]xyz

This domain is flagged as a credential harvesting phishing site under investigation. Analysis indicates it poses a direct threat to users by impersonating legitimate platforms under the guise of 'EarnElite,' likely designed to capture login credentials or financial information. The infrastructure exhibits characteristics typical of phishing campaigns, including the use of evasion techniques to delay detection. Infrastructure analysis reveals the domain was registered on February 21, 2026, through Spaceship, Inc., and resolves to the IP address 172.67.213.86. It employs Cloudflare services, HTTP/3, and a Google Trust Services SSL certificate, which may obscure its true origin. Detection metrics show 0/95 detections on VirusTotal, a Gridinsoft trust score of 0/100, and presence on one security blocklist. The page title 'EarnElite' and embedded YouTube content suggest an attempt to lend legitimacy to the fraudulent scheme. Mitigation steps for this threat type include immediate blocking of the domain and associated IP address across network security controls. Organizations should monitor for user interactions with the domain, particularly login attempts or form submissions, and reset credentials for any accounts exposed to the site. Security teams are advised to inspect SSL certificates and hosting patterns for similar domains registered through Spaceship, Inc., or utilizing Cloudflare with HTTP/3. End-users should be educated on recognizing phishing page titles and verifying domain authenticity before entering sensitive information.