yafin[.]top

Analysis indicates that yafin.top was registered on February 21 2026 and currently resolves to 172.67.141.123, an address owned by Cloudflare (AS13335) located in the United States. The domain is presently taken offline, which limits immediate interaction but does not remove the underlying infrastructure from threat assessments. VirusTotal scans have returned 12 positive detections out of 93 submitted engines, demonstrating that multiple security products have identified malicious behavior associated with the host. Gridinsoft assigns a trust score of 0 out of 100, confirming a lack of confidence in the domain's legitimacy.

The SSL certificate is labeled WE1, indicating a weak or self‑signed certificate that fails standard trust validation. Reputation data shows the domain appears on a single security blocklist and is listed in one AlienVault OTX pulse, reflecting limited but existing community awareness. PhishDestroy has also blocked the domain, reinforcing its classification as a phishing vector. The combination of a recent creation date, Cloudflare front‑end, low trust score, multiple vendor detections, and inclusion on blocklists suggests the site was used for credential‑harvesting or similar phishing campaigns.

Because the site is offline, direct observation of content is unavailable; therefore, the exact phishing lure, targeted brand, or page structure remains unknown. Defenders should continue to block DNS resolution to 172.67.141.123, update intrusion detection signatures with the observed indicators, and monitor for any re‑use of the domain or associated IP range. Ongoing threat‑intel feeds should be queried for new pulses referencing yafin.top, and any outbound traffic to the IP should be investigated for potential data exfiltration attempts.