earnodot[.]net

The domain earnodot.net is currently classified as an active generic phishing operation. Infrastructure analysis shows the domain resolves to the IPv4 address 91.235.142.249 and is serviced by the authoritative name servers ns21.v-sys.org and ns22.v-sys.org. Registration data indicates the domain was created on January 02, 2025 through the registrar NameSilo, LLC. Threat‑intel feeds have placed the domain on a single security blocklist and it is explicitly blocked by the PhishDestroy service, confirming that at least one reputable anti‑phishing organization has observed malicious activity associated with this host.

VirusTotal scans have resulted in two detections out of ninety‑one submitted security vendors, providing additional corroboration of its malicious nature. No public evidence was found regarding SSL/TLS certificates, HTTP response codes, page titles, or content analysis, leaving those vectors unverified at this time. Defenders should treat earnodot.net as hostile and enforce network‑level blocks on the domain and its resolved IP address.

Continuous monitoring of DNS queries for the domain and its name servers is advised, as is the inclusion of the host in endpoint and email security policies that reference known phishing indicators. Where possible, sinkholing or redirecting traffic to a safe remediation page can reduce user exposure. Because the domain remains active, threat‑hunting activities should include correlation of any outbound connections to 91.235.142.249 with internal logs to detect potential compromise attempts.