earneviue-cyhgad[.]xyz

This domain, earneviue-cyhgad.xyz, is flagged as a generic phishing site targeting users with a credential harvesting scheme. The page title, EarnElite, suggests an attempt to impersonate a rewards or financial platform, though no specific brand affiliation has been confirmed. No drainer kit signatures were detected in initial scans, but the domain exhibits characteristics typical of low-sophistication phishing infrastructure designed to capture login credentials or personal data. Analysis indicates the domain was registered on February 21, 2026, through Spaceship, Inc., and resolves to the IP address 188.114.97.3. VirusTotal reports 0/95 detections, meaning no antivirus engines have flagged the domain at the time of analysis. The domain appears on one security blocklist and is currently blocked by PhishDestroy. Google Safe Browsing (GSB) does not list the domain, and the SSL certificate is issued by Google Trust Services, providing a false sense of legitimacy. Detected technologies include YouTube embeds, Cloudflare hosting, and HTTP/3, which are often leveraged to evade detection and improve delivery speed. The domain is currently offline, likely due to takedown efforts or abandonment by the threat actor. However, the risk remains until further investigation confirms the absence of residual infrastructure. Users who interacted with the domain should assume credential exposure and initiate password resets on any accounts accessed during the period of activity. Organizations should monitor for related domains registered through the same registrar or resolving to the same IP range, as threat actors frequently reuse infrastructure for subsequent campaigns.