# earn-masafinance.pages.dev — SUSPICIOUS > earn-masafinance.pages.dev impersonates Yearn finance in a confirmed scam site hosted on Cloudflare at 172.66.44.137. ## Summary PhishDestroy identifies earn-masafinance.pages.dev as an active brand impersonation site targeting Yearn users. The domain remains under investigation as of this report but has not been neutralized and continues to pose a direct threat to cryptocurrency investors seeking Yearn services. This domain is flagged by 0 of 95 VirusTotal vendors, is registered through Cloudflare, Inc., and resolves to IP 172.66.44.137. It utilizes a Google Trust Services SSL certificate, increasing its appearance of legitimacy while actively misleading users into believing it is an official Yearn platform. The domain is currently active and continues to impersonate the Yearn brand. Users are strongly advised to avoid interacting with earn-masafinance.pages.dev. Verify all URLs against official sources before entering credentials or making transactions. Block the IP 172.66.44.137 at the network level if possible. Report this domain to your security team, browser vendor, and Yearn support immediately to aid in takedown efforts. ## Threat Details - Verdict: SUSPICIOUS - Site status: unknown (HTTP ?) - Target brand: Yearn ## Domain Intelligence - Registrar: Cloudflare, Inc. - IP: 172.66.44.137 ## Detection Status - VirusTotal: 0 vendors flagged - Google Safe Browsing: clean - Blocklists: 0 hits ## Evidence - Cloudflare Radar: https://radar.cloudflare.com/scan/04a5fd39-1c19-4db5-822c-c8ee8c5f7196 - PhishDestroy: https://phishdestroy.io/domain/earn-masafinance.pages.dev/ - LLM endpoint: https://phishdestroy.io/domain/earn-masafinance.pages.dev/llm.txt ## If You Visited This Site 1. Change any passwords you may have entered 2. Enable 2FA on all related accounts 3. Monitor your accounts for unauthorized activity 4. Report to: FBI IC3, Europol, local authorities --- Report by PhishDestroy | https://phishdestroy.io/domain/earn-masafinance.pages.dev/ Last updated: 2026-03-28