usdc-defi-lm[.]top

Analysis of the domain usdc-defi-lm.top reveals infrastructure consistent with a crypto drainer scam, currently offline as of July 23, 2026. The domain was registered on February 21, 2026, and is flagged by 19 of 93 security vendors on VirusTotal, indicating elevated risk. It appears on one security blocklist and was identified in a single AlienVault OTX threat intelligence pulse, further supporting its malicious classification.

The domain resolves to IP 172.67.132.98, hosted on Cloudflare's network (AS13335), a common choice for threat actors due to its proxy services and ease of deployment. The SSL certificate is classified as WE1, a low-trust category often associated with newly registered or suspicious domains. While the exact content of the site remains unanalyzed, the scam type is explicitly labeled as a crypto scam, aligning with the domain's naming pattern (usdc-defi-lm), which suggests a focus on decentralized finance and USD Coin-related fraud.

Defenders should treat this domain as compromised and block it at the network level, particularly in environments handling cryptocurrency transactions. The domain's current offline status does not eliminate risk, as it may resurface under similar infrastructure or be reused in future campaigns. Monitoring for related domains with comparable naming conventions (e.g., usdc-defi, defi-lm) and shared hosting characteristics (Cloudflare IPs, WE1 SSL certificates) is recommended to preemptively mitigate associated threats.