v3-yearn[.]cc

Analysis of v3-yearn.cc indicates this domain is a brand impersonation scam targeting Yearn Finance, a decentralized finance (DeFi) platform. The domain was registered on February 21, 2026, through NiceNIC International Group Co., Limited, and has since been flagged by multiple security vendors. As of July 23, 2026, the domain is offline, but prior infrastructure analysis reveals it resolved to IP address 188.114.96.3, hosted on Cloudflare's network (AS13335). The SSL certificate, issued by Google Trust Services (WE1), and the use of Cloudflare nameservers (cory.ns.cloudflare.com, megan.ns.cloudflare.com) align with common patterns observed in malicious infrastructure leveraging CDN services to obscure origin servers.

The domain appears on three security blocklists, and seven out of 93 security vendors on VirusTotal flagged it as malicious. Gridinsoft assigns a trust score of 0/100, further corroborating its classification as a scam. The page title, 'www.www.v3-yearn.cc,' suggests an attempt to mimic legitimate Yearn Finance URLs, though no direct evidence of the site's content or functionality is available for analysis. The domain was blocked by PhishDestroy, MetaMask, and SEAL, indicating prior detection by both general and crypto-specific security tools.

Defenders should treat this domain as confirmed malicious infrastructure. While the site is currently offline, the registration details, hosting provider, and detection history warrant continued monitoring. Organizations should ensure blocklist updates include this domain and consider proactive DNS filtering to prevent potential re-emergence. No evidence suggests this domain is safe for user interaction.