agnifinance[.]live

The domain agnifinance.live is identified as a brand impersonation threat targeting Yearn, a well-known decentralized finance (DeFi) platform. The domain is currently offline, which may indicate that it has been taken down or is no longer active.

Analysis of the domain reveals that it has been flagged by 5 out of 95 security vendors on VirusTotal, indicating a moderate level of suspicion among the security community. The domain was registered through Web Commerce Communications Limited dba WebNic.cc and resolves to the IP address 172.67.167.251. The creation date is not specified, but the domain appears on one security blocklist and has a Gridinsoft trust score of 0/100, which is the lowest possible score and suggests a high level of risk. The use of Cloudflare technologies, including Cloudflare Browser Insights and HTTP/3, may have been employed to mask the true origin and enhance the credibility of the impersonation.

Given the current status of the domain being offline, the immediate threat posed by agnifinance.live is reduced. However, the elevated risk level and the specific targeting of Yearn suggest that the domain may have been used in past fraudulent activities. Users are advised to exercise caution and avoid visiting this domain if it becomes active again. Security teams should monitor the domain for any signs of reactivation and consider adding it to their blocklists to prevent potential future attacks. Additionally, any related IP addresses or registrant information should be investigated for further threats.