evaa-finance[.]com

The domain evaa-finance.com was registered on February 21, 2026 through Dominet (HK) Limited and is currently hosted behind Cloudflare services (ASN13335, United States). DNS resolution points to IP address 104.21.3.38, which resolves to Cloudflare’s edge network and is served over HTTP/3. The authoritative nameservers are danica.ns.cloudflare.com and kolton.ns.cloudflare.com, and the TLS certificate is issued by Google Trust Services under the WE1 root, confirming a valid HTTPS endpoint. When accessed, the site returns a 522 Connection timed out page title, indicating that the origin server failed to respond within Cloudflare’s timeout window.

The domain is listed on a single security blocklist and has been explicitly blocked by the PhishDestroy feed. VirusTotal analysis shows that 2 of 93 scanning engines flagged the domain, reinforcing the suspicion of malicious activity. The intelligence record classifies the infrastructure as a brand‑impersonation campaign targeting the Yearn brand. No additional page content or phishing page samples have been captured, leaving the exact lure or credential‑harvesting mechanism unknown.

Defenders should add evaa-finance.com to URL filtering and DNS block lists, monitor the associated IP range for similar Cloudflare‑proxied domains, and enforce outbound traffic controls that prevent connections to newly registered domains resolving to Cloudflare edge nodes. Continuous reputation checking, especially on VirusTotal and other multi‑engine platforms, is recommended to capture any future changes in detection status. Given the confirmed use of a reputable CDN and a valid TLS certificate, the domain may bypass basic heuristic checks, so contextual threat intelligence such as the brand‑impersonation tag should be incorporated into detection rules to improve early identification.