yearn[.]fi-wailet-connect-api-v3[.]com

This domain is flagged as an elevated-risk phishing infrastructure specifically designed for brand impersonation targeting Yearn, a decentralized finance protocol. The site mimics Yearn's wallet connection API (v3), a critical component for user authentication and transaction signing, posing a direct threat to cryptocurrency holders by attempting to harvest private keys or login credentials through fraudulent API interactions. Analysis indicates the domain yearn.fi-wailet-connect-api-v3.com was registered on February 21, 2026, and resolves to the IP address 172.67.185.99, hosted on Cloudflare's network (AS13335). The SSL certificate is classified as WE1, a low-trust indicator. VirusTotal reports 12 out of 95 security vendors flagging the domain as malicious, while it appears on one security blocklist and is actively blocked by at least one threat intelligence feed. The domain's infrastructure leverages Cloudflare's CDN, a common tactic to obscure hosting origins and evade detection. Mitigation steps for this specific threat type include immediate blocking of the domain and its associated IP (172.67.185.99) at the network perimeter. Organizations should deploy indicators of compromise (IOCs) to endpoint detection systems, prioritizing domains with similar naming patterns (e.g., typosquatting of 'yearn.fi' combined with 'wallet-connect-api'). Users should be advised to verify API endpoints directly through Yearn's official documentation and avoid interacting with unsolicited wallet connection prompts. Security teams are recommended to monitor for unusual outbound traffic to Cloudflare-hosted IPs, particularly those resolving to newly registered domains impersonating cryptocurrency services.