blockearner[.]com[.]au

The domain blockearner.com.au is currently listed as an active generic phishing site with a high risk rating. The site presents the page title “Block Earner | Home of Australia’s Crypto‑Backed Loans”, indicating an attempted lure related to cryptocurrency‑backed lending. The domain was registered on 21 February 2026 through GoDaddy.com, LLC. Infrastructure analysis shows the domain resolves to the IPv4 address 18.67.93.77, which belongs to Amazon.com, Inc. (AS16509) and is geolocated in Australia. The site is served over TLS with an Amazon RSA 2048 M01 certificate and uses Amazon DNS nameservers (ns-1029.awsdns-00.org, ns-128.awsdns-16.com, ns-1935.awsdns-49.co.uk, etc.). HTTP requests return a 200 status code, and the observed technology stack includes Salesforce, Bootstrap, Amazon Web Services, Zendesk, reCAPTCHA, HSTS, Amazon SES and Amazon S3. Threat intelligence sources have observed the domain on a single security blocklist and flag it as malicious in one of ninety‑five VirusTotal scanners. PhishDestroy has already blocked the domain, and Gridinsoft assigns it a trust score of 0 out of 100. The domain also appears in one AlienVault OTX pulse, providing additional corroboration of its malicious intent. Defenders should add blockearner.com.au to network and endpoint deny lists, and consider blocking its hosting IP 18.67.93.77 to mitigate further exposure. Continuous monitoring of DNS queries for the associated nameservers can help detect any future infrastructure reuse. Updating intrusion detection signatures with the observed TLS certificate fingerprint and the listed technology fingerprints will improve detection of similar campaigns.