openfinance[.]to

PhishDestroy identifies openfinance.to as an active brand impersonation scam targeting Yearn users with a crypto drainer mechanism. The domain is currently under investigation but remains active and unresolved. Threat actors are leveraging Yearn’s established brand to deceive users into connecting wallets or providing sensitive credentials under false pretenses. Immediate action is required to mitigate exposure.

This domain, registered on February 12, 2026 through NAMECHEAP INC, resolves to IP address 5.78.176.218 and is secured with a Let’s Encrypt SSL certificate. Despite zero detections on VirusTotal (1 of 95 vendors), the absence of blocking underscores the need for proactive defense. Trust scores remain critically low, and the domain has not been listed on major blocklists at this time. The recent creation and clean detection profile suggest a stealthily deployed threat designed to evade initial automated screening.

Given the confirmed brand impersonation and active status, PhishDestroy recommends immediate domain blocking and user notification. Users should avoid clicking links, refrain from connecting wallets, and verify all Yearn-related communications through official channels. Security teams are advised to add openfinance.to to blocklists and monitor for related campaigns. This domain exemplifies the rising trend of crypto drainers exploiting high-value DeFi brands in 2026.