yieldinifinifi[.]xyz

Analysis of the domain yieldinifinifi.xyz shows that it was registered on March 6 2026 through NiceNIC International Group Co., Limited and immediately pointed to the Cloudflare edge address 172.67.158.65, which is announced as part of AS13335 in the United States. The domain resolves to a Cloudflare‑provided IP and uses the authoritative nameservers olga.ns.cloudflare.com and rocco.ns.cloudflare.com. No TLS certificate is presented, indicating that HTTPS connections are not established.

HTTP requests return a generic page whose title is “Just a moment…”, and the site has been taken offline at the time of reporting. VirusTotal scans reported a single positive detection out of 94 submitted engines, and the domain is listed on one public phishing blocklist, specifically PhishDestroy. The only publicly disclosed malicious purpose is an investment‑related phishing campaign, as indicated by the “Investment Scam” label in the intelligence feed.

The limited detection footprint suggests that the site may have been short‑lived or rapidly taken down, but the presence of a Cloudflare front‑end and a confirmed positive detection confirm its malicious intent. Defenders should block the domain at the DNS level, add the IP address 172.67.158.65 to any network‑level deny lists, and monitor for any future re‑use of the same nameservers or Cloudflare edge IPs. Continuous monitoring of VirusTotal, PhishDestroy, and other threat‑intel feeds is recommended to capture any re‑appearance, and any inbound traffic from the domain should be logged and investigated for credential harvesting attempts.