Domain security and threat intelligence

yieldfarm.web.app

Name: yieldfarm.web.app — PhishDestroy evidence record
Published: 2026-09-05
License: https://creativecommons.org/licenses/by/4.0/

In short

PhishDestroy stores a record for yieldfarm.web.app. Source observations are dated separately; missing checks do not establish safety.

“The Wallet Checker · Yield Farm”

Review the evidence

Registrar: Google Domains
Resolved IP: 199.36.158.100FASTLY - Fastly, Inc., US · CDN
First observed: Sep 5, 2026

PhishDestroy assessment Critical

83/100

Evidence score

Availability Last known active Latest stored reachability observation Observed Nov 1, 2026 · 03:10 UTCHTTP probe

Risk signals

VirusTotal detections: 2/92 Stored blocklist matches: 2

VirusTotal

2 / 92

engine detections · 2026-10-19

Blocklist matches

MetaMask, SEAL

URLQuery

detections

URLScan

Malicious

engine verdict · score 97

Page captures

open gallery

Questions about yieldfarm.web.app

Is yieldfarm.web.app legit?

PhishDestroy stores a record for yieldfarm.web.app. Source observations are dated separately; missing checks do not establish safety.

Is yieldfarm.web.app safe to connect a wallet?

This report does not record which wallet requests yieldfarm.web.app makes. Because of the risk signals above, do not connect a wallet, sign messages or approve token permissions there. A confirmed blockchain transaction cannot be reversed.

What should I do if I used yieldfarm.web.app?

It depends on what you did. If you entered a password, change it, and also on every other site where you used the same password; turn on two-factor authentication where it is offered. If you paid or gave card or bank details, contact your bank or payment service through the contacts on your card or its official website. If you only connected a wallet, disconnect the site in the wallet and reject pending requests; a connection by itself does not move funds. If you signed a token approval or permit, revoke it with a token-approval checker. If you shared a seed phrase or private key, treat the wallet as compromised and move the remaining funds to a new wallet with a new seed phrase. If you downloaded a file, do not open it and scan the device with security software. Keep the address, dates, payment or transaction details and messages for a report to the police or another competent authority; a report does not guarantee that money is returned. Step-by-step help: emergency guide.

Explore

Source evidenceVirusTotal 2 / 92 8 sources

VirusTotal

2 / 92 engine detections · stored summary

2026-10-19 02:05 UTC

Open report

VirusTotalOriginal source recordObserved: 2026-10-19 02:01:21 UTC14 fields

Observed: 2026-10-19T02:01:21Z · Retrieved: 2026-10-23T02:27:35Z

Vendor result counts

Timeout: 0
Harmless: 54
Malicious: 2
Suspicious: 0
Undetected: 36

Vendor labels

alphaMountain.ai: phishing
Forcepoint ThreatSeeker: phishing

Reputation score

Registrar

MarkMonitor Inc.

Created

2019-01-08 22:05:04 UTC

Expires

2026-01-08 22:05:04 UTC

Updated

2024-12-12 10:14:49 UTC

First seen

2026-09-05 14:50:59 UTC

DNS records

TTL, seconds
21600
Type
A
Value
199.36.158.100
TTL, seconds
21600
Type
AAAA
Value
2620:0:890::100

DNS records observed

2026-10-19 02:01:32 UTC

JARM fingerprint

29d3fd00029d29d00041d41d00041d6b5eefa2404a56c2ced79a0d16afe36c

Certificate

Subject alternative names: web.app
*.web.app
Issuer: Google Trust Services / WR4
Serial: e26d762a101120cd12a8f68d86c31d05
SHA-256: 7175912cef4e9b3d3f320d60e4e926f7cb6a2f624028de25218038a3f679e095
Subject: web.app
Valid until: 2026-12-22 17:59:57 UTC
Valid from: 2026-09-23 17:59:58 UTC

Registration record

Registrar: MarkMonitor Inc.
Registrar IANA ID: 292
Registrar URL: http://www.markmonitor.com
Registered: 2019-01-08 22:05:04 UTC
Updated: 2024-12-12 10:14:49 UTC
Expires: 2026-01-08 22:05:04 UTC
Status: clientDeleteProhibited
clientTransferProhibited
clientUpdateProhibited
Nameservers: ns1.googledomains.com
ns2.googledomains.com
ns3.googledomains.com
ns4.googledomains.com
DNSSEC: unsigned

Original source fields · JSON

Vendor result counts	{ "timeout": 0, "harmless": 54, "malicious": 2, "suspicious": 0, "undetected": 36 }
Vendor labels	{ "alphaMountain.ai": "phishing", "Forcepoint ThreatSeeker": "phishing" }
Reputation	0
Categories	{ "Sophos": "information technology", "alphaMountain.ai": "Phishing (alphaMountain.ai)", "Forcepoint ThreatSeeker": "phishing and other frauds" }
Registrar	MarkMonitor Inc.
Created	2019-01-08T22:05:04Z
Expires	2026-01-08T22:05:04Z
Updated	2024-12-12T10:14:49Z
First seen	2026-09-05T14:50:59Z
DNS records	[ { "ttl": 21600, "type": "A", "value": "199.36.158.100" }, { "ttl": 21600, "type": "AAAA", "value": "2620:0:890::100" } ]
Dns at	2026-10-19T02:01:32Z
Jarm	29d3fd00029d29d00041d41d00041d6b5eefa2404a56c2ced79a0d16afe36c
Certificate	{ "san": [ "web.app", "*.web.app" ], "issuer": "Google Trust Services / WR4", "serial": "e26d762a101120cd12a8f68d86c31d05", "sha256": "7175912cef4e9b3d3f320d60e4e926f7cb6a2f624028de25218038a3f679e095", "subject": "web.app", "valid_to": "2026-12-22T17:59:57Z", "valid_from": "2026-09-23T17:59:58Z" }
Registration record	{ "registrar": "MarkMonitor Inc.", "registrar_iana_id": "292", "registrar_url": "http://www.markmonitor.com", "created": "2019-01-08T22:05:04Z", "updated": "2024-12-12T10:14:49Z", "expires": "2026-01-08T22:05:04Z", "status": [ "clientDeleteProhibited", "clientTransferProhibited", "clientUpdateProhibited" ], "nameservers": [ "ns1.googledomains.com", "ns2.googledomains.com", "ns3.googledomains.com", "ns4.googledomains.com" ], "dnssec": "unsigned" }

Separate source record · 2 malicious + 0 suspicious / 92 · 2026-10-19 02:01:21 UTC

The summary above and this provider record were collected at different times. Both remain available; malicious and suspicious classifications are shown separately.

record_source: collected_observations.vt
analysis_at: 2026-10-19T02:01:21Z
fetched_at: 2026-10-23T02:27:35Z
stats: {"timeout":0,"harmless":54,"malicious":2,"suspicious":0,"undetected":36}

URLQuery

2 det.

2026-10-25 11:50 UTC

Open report

URLScan

Malicious · engine verdict · score 97

2026-09-05 15:01 UTC

Open report

URLScanOriginal source recordObserved: 2026-09-05 15:01:54 UTC23 fields

Observed: 2026-09-05T15:01:54Z · Retrieved: 2026-10-21T03:49:26Z

Report ID

01a07217-0cbe-7466-8108-cfe0e04e3871

Final URL

https://yieldfarms.firebaseapp.com/

HTTP response

200

Redirect type

off-domain

Redirects

To
https://yieldfarm.web.app/
From
http://yieldfarm.web.app/
Status
307
To
https://yieldfarms.firebaseapp.com/
From
https://yieldfarm.web.app/
Status
301

IP address

2620:0:890::100

Contacted domains

esm.sh
zen.claims
explorer-api.walletconnect.com
rh.farm
relay.walletconnect.org
surround-arrow-diy-fioricet.trycloudflare.com
bsc-dataseed1.bnbchain.org
yieldfarm.web.app

Contacted IP addresses

172.67.70.222
2606:4700::6810:e784
172.66.147.126
172.67.218.113
2606:4700:3031::ac43:da71
52.212.154.202
199.36.158.100
188.114.96.3
2620:0:890::100

Autonomous systems (ASN)

13335
16509
54113

Server countries

Linked domains

rh.farm
x.com
discord.gg

Social media links

https://x.com/YieldFarmRH
https://discord.gg/yieldfarm

Document hash

c8dbec06cfa631fba23ba2a4263c9a55f02292551549bc9ec4d3fa74b9d6a05e

Script hashes

f962df75b5cb56f06e794da1b94f8fb8c06f8c3ccf3e1723c0841b058ccb108f
08c4fd72f9d96a7aa554510dff2c293973b1b092dff1b9b282bce9111b50ef41

JavaScript globals

__next_f
_0x1031
_0x307c
__PROXY__
__RC__
__SAFE_KIT__
__SAFE_ADAPTER__
_ethers
Buffer
__PM_CLICK_BOUND__
CFG
__PM_HIDE_WALLET_UI__
__PM_BOOTED__
_walletConnectCore__count
downloadLogsBlobInBrowser
_walletConnectCore_

TLS session and certificate

Subject alternative names: firebaseapp.com
*.firebaseapp.com
Cipher: AES_128_GCM
Issuer: WR4
Subject: firebaseapp.com
Protocol: TLS 1.3
Valid until: 2026-10-18 15:01:15 UTC
Valid from: 2026-07-20 15:01:16 UTC

Domain age, days

Registered domain age, days

Certificate age, days

Certificate validity, days

Page requests

Provider verdicts

Engine verdict

Tags: urlscan-ml
urlscan-ml-60c5e22
Score: 97
Malicious: Yes

Overall verdict

Score: 0
Malicious: No

HTTP headers

Content-type: text/html; charset=utf-8
Strict-transport-security: max-age=31556926; includeSubDomains; preload

Original source fields · JSON

Uuid	01a07217-0cbe-7466-8108-cfe0e04e3871
Final url	https://yieldfarms.firebaseapp.com/
Status	200
Redirected	off-domain
Redirects	[ { "to": "https://yieldfarm.web.app/", "from": "http://yieldfarm.web.app/", "status": 307 }, { "to": "https://yieldfarms.firebaseapp.com/", "from": "https://yieldfarm.web.app/", "status": 301 } ]
Ip	2620:0:890::100
Contacted domains	[ "esm.sh", "zen.claims", "explorer-api.walletconnect.com", "rh.farm", "relay.walletconnect.org", "surround-arrow-diy-fioricet.trycloudflare.com", "bsc-dataseed1.bnbchain.org", "yieldfarm.web.app" ]
Contacted IP addresses	[ "172.67.70.222", "2606:4700::6810:e784", "172.66.147.126", "172.67.218.113", "2606:4700:3031::ac43:da71", "52.212.154.202", "199.36.158.100", "188.114.96.3", "2620:0:890::100" ]
Asns	[ "13335", "16509", "54113" ]
Countries	[ "US", "IE" ]
Linked domains	[ "rh.farm", "x.com", "discord.gg" ]
Social	[ "https://x.com/YieldFarmRH", "https://discord.gg/yieldfarm" ]
Document hash	c8dbec06cfa631fba23ba2a4263c9a55f02292551549bc9ec4d3fa74b9d6a05e
Script hashes	[ "f962df75b5cb56f06e794da1b94f8fb8c06f8c3ccf3e1723c0841b058ccb108f", "08c4fd72f9d96a7aa554510dff2c293973b1b092dff1b9b282bce9111b50ef41" ]
Globals	[ "__next_f", "_0x1031", "_0x307c", "__PROXY__", "__RC__", "__SAFE_KIT__", "__SAFE_ADAPTER__", "_ethers", "Buffer", "__PM_CLICK_BOUND__", "CFG", "__PM_HIDE_WALLET_UI__", "__PM_BOOTED__", "_walletConnectCore__count", "downloadLogsBlobInBrowser", "_walletConnectCore_" ]
Tls	{ "san": [ "firebaseapp.com", "*.firebaseapp.com" ], "cipher": "AES_128_GCM", "issuer": "WR4", "subject": "firebaseapp.com", "protocol": "TLS 1.3", "valid_to": "2026-10-18T15:01:15Z", "valid_from": "2026-07-20T15:01:16Z" }
Domain age days	0
Apex age days	0
Tls age days	47
Tls valid days	89
Requests	81
Provider verdicts	{ "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 97, "malicious": true }, "overall": { "score": 0, "malicious": false } }
HTTP headers	{ "content-type": "text/html; charset=utf-8", "strict-transport-security": "max-age=31556926; includeSubDomains; preload" }

Separate monitor record · 2026-09-05 17:08 UTC

Separate stored monitor snapshot; does not replace the primary report record or establish current availability.

record_source: domain_monitor.urlscan
uuid: 01a07217-0cbe-7466-8108-cfe0e04e3871
report_url: https://urlscan.io/result/01a07217-0cbe-7466-8108-cfe0e04e3871/
score: 0
malicious: false
result_at: 2026-09-05T17:08:21Z
enriched_at: 2026-09-06T08:13:17Z
source_timestamps: {"urlscan_result_at":"2026-09-05 19:08:21","urlscan_enriched_at":"2026-09-06 10:13:17"}
timestamp_basis: Europe/Berlin, as used by the existing report; source timestamps are retained verbatim

OTX

no community references

2026-10-16 22:17 UTC

Open report

Cloudflare Radar

provider verdict: clean

Open report

Cloudflare RadarOriginal source recordObserved: 2026-09-05 15:52:02 UTC12 fields

Observed: 2026-09-05T15:52:02Z · Retrieved: 2026-10-21T04:00:13Z

Report ID

50727ed5-8543-4d94-9a6d-8d8fc4eb4a91

Final URL

https://yieldfarms.firebaseapp.com/

HTTP response

200

Redirect type

off-domain

Navigation history

URL
https://yieldfarm.web.app/
Status
301
URL
https://yieldfarms.firebaseapp.com/
Status
200

DOM structure hash

4db7f1b732aa882518d38bcbba435ff74adca6d889941120f815ff0ce0b2c358

Document hash

c8dbec06cfa631fba23ba2a4263c9a55f02292551549bc9ec4d3fa74b9d6a05e