vote-yearn[.]xyz

This domain, vote-yearn.xyz, is flagged as a brand impersonation phishing campaign targeting Yearn, a decentralized finance protocol. Analysis indicates the domain was designed to mimic legitimate Yearn governance or voting platforms, likely to deceive users into disclosing sensitive credentials or authorizing malicious transactions. No explicit drainer kit signatures were identified, but the domain's structure and naming convention align with known phishing tactics in the decentralized finance sector. Infrastructure analysis reveals the domain was registered on March 13, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com. It resolves to the IP address 188.114.96.3, which is associated with Cloudflare services, a common tactic to obscure hosting origins and evade detection. At the time of assessment, the domain was flagged by 1 of 95 security vendors on VirusTotal, indicating limited but confirmed detection. The domain appears on three security blocklists, including MetaMask and PhishDestroy, and is blocked by additional reputation-based systems. Technologies detected include Cloudflare Browser Insights and HTTP/3, further suggesting an attempt to leverage modern web infrastructure for credibility. The domain is currently offline, reducing immediate risk to users. However, the infrastructure remains registered and could be reactivated or repurposed for future campaigns. The registrar, PDR Ltd., has been previously associated with malicious domain registrations, though no enforcement action has been publicly documented in this instance. Users who interacted with the domain prior to its takedown should revoke any associated smart contract approvals and monitor accounts for unauthorized activity. Organizations should update blocklists to include this domain and its resolved IP to mitigate residual risk.