v3-yearn[.]org

The domain v3-yearn.org is confirmed as a high-risk brand impersonation site targeting Yearn, a decentralized finance protocol. Analysis indicates the domain was actively used to deceive users by mimicking the legitimate Yearn platform, likely for fraudulent financial transactions or credential harvesting. The site is currently offline, though prior activity suggests it operated as a crypto-centric threat vector. Infrastructure analysis reveals the domain was registered on April 22, 2025, through NICENIC INTERNATIONAL GROUP CO., LIMITED. Security telemetry shows the domain was flagged by 17 of 95 vendors on VirusTotal, with detection engines categorizing it as malicious or phishing-related. Additionally, the domain appears on five independent security blocklists, including entries from PhishDestroy, Polkadot, Enkrypt, Codeesura, and PhishingDB. The page title, 'www.www.v3-yearn.org,' further indicates an attempt to obfuscate or mislead users regarding its legitimacy. Current status confirms the domain has been taken offline, though residual risk remains for users who may have interacted with it prior to deactivation. Organizations and individuals are advised to block the domain at the network level and monitor for related indicators of compromise. Users who accessed the site should revoke any connected wallet permissions and review transaction histories for unauthorized activity. Proactive measures, such as verifying domain authenticity through official channels, are recommended to mitigate similar threats.