vns[.]earn-en[.]pro

The domain vns.earn-en.pro was observed hosting a generic phishing site and is currently offline as of the assessment date, July 24, 2026. Infrastructure analysis shows the domain resolves to the IP address 188.114.97.3, which belongs to Cloudflare, Inc. (AS13335) and is located in the United States. No SSL certificate is deployed, indicating that connections to the site would have been unencrypted. The HTTP response returned a page titled "Index of /," suggesting the server was presenting a directory listing rather than a custom landing page.

Registration information indicates the domain was provisioned through Cloudflare, Inc., a common choice for fast‑flux or proxy‑based phishing operations. Reputation data reveals that the domain appears on a single security blocklist and has been explicitly blocked by the PhishDestroy service. The Gridinsoft trust score is 0 out of 100, reflecting an extremely low confidence rating. VirusTotal analysis recorded three detections out of ninety‑five scanners, confirming that multiple security vendors identified malicious behavior associated with the domain.

While the available evidence confirms phishing activity, details such as the specific lure, credential‑stealing form, or targeted brand remain unknown because the page content has not been publicly disclosed. Defenders should continue to block the domain at network and endpoint layers, monitor DNS queries for the IP 188.114.97.3, and consider adding the domain to internal blocklists. Ongoing vigilance is advised to detect any re‑hosting attempts that may leverage the same Cloudflare infrastructure, and any future observations should be correlated with the existing blocklist entries and detection signatures.