yff111[.]com

The domain yff111.com is identified as a high-risk crypto drainer, designed to illicitly extract cryptocurrency from victim wallets. Analysis confirms its current status as offline, though prior activity targeted users through deceptive wallet-draining mechanisms. No specific brand impersonation has been confirmed, but the domain’s infrastructure aligns with known cryptocurrency theft campaigns. Technical indicators reveal the domain was registered through GMO Internet, Inc. on March 16, 2026, and previously resolved to the IP address 188.114.96.3. Detection metrics include flags from 11 of 95 security vendors on VirusTotal, presence on four distinct security blocklists, and inclusion in four AlienVault OTX threat intelligence pulses. Additional risk signals include a Gridinsoft trust score of 0/100 and classification under Google Safe Browsing’s SOCIAL_ENGINEERING category. The domain is actively blocked by multiple security layers, including MetaMask and PhishDestroy. Current status indicates the domain has been taken offline, though residual risk persists for users who may have interacted with it during its active phase. Organizations and individuals are advised to implement DNS-based blocking for yff111.com and its associated IP address. Wallet holders should verify transaction histories for unauthorized activity and revoke permissions for any suspicious smart contracts. Proactive monitoring of related infrastructure is recommended, as threat actors frequently re-deploy similar domains.