earnndrop[.]xyz

Analysis of earnndrop.xyz indicates a high‑risk brand‑impersonation campaign targeting the Yearn ecosystem. The domain was registered on 21 February 2026 through NiceNIC International Group Co., Limited and is served via Cloudflare’s network (AS13335) from the IP address 104.21.74.13, located in the United States. DNS resolution points to Cloudflare name servers vida.ns.cloudflare.com and wesley.ns.cloudflare.com, confirming the use of Cloudflare’s edge infrastructure. An SSL certificate issued by Google Trust Services (WE1) is present, which is typical for legitimate sites but does not preclude malicious use. HTTP requests return a 403 status code and the page title displayed is “Just a moment…”, a pattern often associated with Cloudflare challenge pages that can be employed to hide malicious content behind a verification wall.

Reputation services show a low trust rating: Scamadviser assigns a score of 30/100 while Gridinsoft rates the site at 0/100. VirusTotal analysis reports that three of ninety‑five antivirus engines flag the domain, indicating that at least some security products have detected suspicious activity. The domain appears on one public blocklist and has been blocked by the PhishDestroy service, reinforcing the view that it is being used for phishing or credential‑stealing operations. The identified scam type is “Brand Impersonation” and the target brand is Yearn, as indicated in the intelligence feed. Current evidence does not reveal the exact landing page content beyond the generic title, nor does it disclose any credential‑collection forms or malicious payloads.

Consequently, the precise tactics employed by the actors remain uncertain. Defenders should treat earnndrop.xyz as malicious, add the domain to blocklists, monitor DNS queries for the associated IP address and Cloudflare name servers, and update URL filtering rules to deny traffic to the domain.