earnbywritingletters[.]com

This domain, earnbywritingletters.com, is currently offline but its historical infrastructure provides clear indicators of a brand‑impersonation campaign targeting Binance users. DNS resolution points to the IPv4 address 206.217.128.210, which is hosted in the United States by AS36352 HostPapa. The domain was registered on 19 July 2025 through the registrar Name SRS AB, and no TLS certificate was ever observed, indicating that any web service would have been delivered over plain HTTP. The sole page title retrieved from the site reads “Satrix Plus Finance – Affiliate marketing world's passive income aggregator,” which aligns with the listed scam type of an investment scam and suggests an attempt to lure victims with promises of passive income.

Trust‑rating services consistently mark the site as highly suspicious, with Scamadviser assigning a score of 1 / 100 and Gridinsoft reporting 0 / 100. Malware‑analysis aggregators have recorded a single vendor detection on VirusTotal (1 of 95 scanners flagged the domain), and the domain appears on one public security blocklist. AlienVault OTX references the domain in one threat‑intelligence pulse, and PhishDestroy has explicitly blocked it.

The evidence set confirms that the operator is impersonating the Binance brand, although the exact phishing or credential‑harvesting mechanisms have not been publicly disclosed. Defenders should continue to block the domain and its associated IP address at network borders, monitor for any re‑registration attempts, and ensure that outbound traffic to HostPapa‑owned ranges is inspected for anomalous payloads. Additional verification of the site’s content, if it reappears, would be advisable to capture any malicious scripts or credential‑stealing forms that may be deployed.