yumi-finance-leap[.]lovable[.]app

Analysis of yumi-finance-leap.lovable.app indicates a high-risk phishing domain actively targeting users of blockchain-based Buy Now, Pay Later (BNPL) services. The domain, registered through Cloudflare, resolves to 185.41.148.2 (Sweden) and is served by Cloudflare nameservers ivan.ns.cloudflare.com and rafe.ns.cloudflare.com. Infrastructure reveals a 302 HTTP redirect, suggesting dynamic routing likely intended to evade detection or filter traffic. The site presents itself as 'Yumi Finance - The Future of Blockchain BNPL' per the page title, though no further content analysis has been conducted to confirm visual or functional mimicry of legitimate services. Security vendors have flagged the domain, with three of 91 engines on VirusTotal detecting malicious activity. The domain is blocked by multiple security providers, including PhishDestroy, MetaMask, and SEAL, and holds a Gridinsoft trust score of 0/100. The SSL certificate is issued by Google Trust Services (WE1), a common practice among phishing sites to appear legitimate. No evidence of a phishing kit or specific brand impersonation beyond the page title is currently available, though the BNPL theme aligns with known attack vectors targeting cryptocurrency users. Defenders should treat this domain as active and malicious. The combination of Cloudflare infrastructure, low trust scores, and security vendor blocks strongly supports classification as a phishing site. Network-level blocking of 185.41.148.2 and monitoring for related subdomains under lovable.app are recommended. Further investigation into the redirect chain and backend infrastructure may reveal additional indicators of compromise.