etarn[.]ai-cryptolist[.]com

This domain is flagged for elevated risk due to brand_impersonation, specifically targeting Yearn Finance, a decentralized finance protocol. The threat involves fraudulent replication of Yearn's branding, interfaces, or communication channels to deceive users into disclosing credentials, transferring assets, or interacting with malicious smart contracts. Analysis indicates a deliberate attempt to exploit trust in the Yearn ecosystem, likely for financial gain or credential harvesting. Infrastructure analysis reveals the domain etarn.ai-cryptolist.com was registered on April 11, 2026, through Key-Systems GmbH. It is currently active and appears on at least one security blocklist, with PhishDestroy marking it as malicious. VirusTotal reports 17 out of 95 security vendors flagging the domain as harmful. The SSL certificate is issued by Google Trust Services, which may lend a false sense of legitimacy to unsuspecting users. No associated IP addresses or hosting providers were explicitly provided, but the domain's structure and naming convention suggest an attempt to mimic cryptocurrency or DeFi-related services. Mitigation steps for this threat include immediate blocking of the domain across all network security controls, including firewalls, DNS filters, and email gateways. Organizations and users should verify the authenticity of any communication or interfaces claiming to be from Yearn by cross-referencing official channels, such as the Yearn Finance website or verified social media accounts. Enhanced monitoring for unusual transaction patterns or login attempts from users who may have interacted with this domain is recommended. Security teams should also conduct retroactive scans for indicators of compromise, such as visits to etarn.ai-cryptolist.com or related subdomains, and educate users on identifying brand_impersonation tactics, particularly in the DeFi space.