yieldlayer[.]fun

The domain yieldlayer.fun was registered on April 23, 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED and is currently active. DNS resolution points to the Cloudflare IP address 172.67.208.152, which is geolocated to Canada and is served by Cloudflare's infrastructure (nameservers davina.ns.cloudflare.com and marek.ns.cloudflare.com). The site presents an HTTP 403 response and the only observed page title is "Just a moment...". SSL is provided by a Let's Encrypt certificate (issuer E8). Reputation data shows a Gridinsoft trust score of 0/100 and the domain appears on three security blocklists. It has been flagged by multiple defensive products, including PhishDestroy, MetaMask, and SEAL. AlienVault OTX references the domain in one threat‑intel pulse, and VirusTotal analysis records seven detections out of ninety‑four scanning engines. The classification in the intelligence feed is generic_phishing with a high risk level. While the exact content and phishing payload have not been publicly disclosed, the convergence of recent registration, low trust score, blocklist presence, and multiple vendor detections indicate a purposeful malicious campaign. Defenders should treat yieldlayer.fun as hostile, enforce network‑level blocking, monitor DNS queries for the associated IP and nameservers, and consider adding the domain to internal threat‑intel feeds. Ongoing observation is advised to capture any evolution of the payload or additional indicators of compromise.