earnwithletterwriting[.]org

Analysis indicates that the domain earnwithletterwriting.org was registered on 16 July 2025 through PDR Ltd. d/b/a PublicDomainRegistry.com. The domain resolves to the IPv4 address 206.217.128.210, which is assigned to AS36352 operated by HostPapa in the United States. No SSL certificate is presented, leaving traffic unencrypted and susceptible to interception. The site is currently taken offline, and the single nameserver configuration further limits visibility into its DNS infrastructure. Threat intelligence classifies the domain as a banking phishing operation. The page title retrieved from the live snapshot reads “Satrix Plus Finance – Affiliate marketing world's passive income aggregator,” suggesting an attempt to masquerade as a financial affiliate service.

The domain appears on one security blocklist and is specifically listed by PhishDestroy, confirming its recognition by anti‑phishing communities. VirusTotal scanning shows that three of ninety‑five security vendors flagged the domain, providing additional corroboration of malicious intent. Evidence confirms that the domain is associated with a generic phishing campaign targeting banking credentials, yet the exact phishing kit or credential‑harvesting mechanisms have not been disclosed. The lack of HTTPS and the offline status impede deeper content analysis, leaving the precise lure and payload unknown. Nonetheless, the convergence of registration data, hosting attribution, blocklist inclusion, and vendor detections establishes a credible risk profile.

Defenders should immediately block traffic to earnwithletterwriting.org and its resolved IP address 206.217.128.210 at network perimeters. Adding the domain to internal URL filtering and DNS sinkhole lists will prevent accidental user exposure. Continuous monitoring of the HostPapa AS for related newly registered domains is advised, as the hosting provider has been leveraged for similar phishing infrastructure in the past.