usdcui1-ed4z22f6mw[.]edgeone[.]app

This domain is flagged as a targeted cryptocurrency phishing operation designed to deceive users into interacting with a fraudulent USDC token swap interface. The page, titled 'USDC Unblock Token Risky Swap Tool,' mimics legitimate decentralized finance platforms to harvest wallet credentials, private keys, or execute unauthorized token transfers. Analysis indicates the site specifically exploits users seeking to unblock or recover USDC tokens, a common tactic in crypto-focused phishing schemes to exploit urgency and perceived financial opportunity. Infrastructure analysis reveals multiple high-confidence threat indicators. The domain was registered on February 21, 2026, through MarkMonitor, Inc., an enterprise-grade registrar frequently abused for phishing due to its reputation and domain management features. It resolves to the IP address 43.152.26.58 and is currently offline, though prior scans detected malicious activity from 2 out of 95 security vendors on VirusTotal. The domain appears on three independent security blocklists, including cryptocurrency-specific threat intelligence feeds, further corroborating its malicious classification. The SSL certificate, issued by DigiCert, Inc., does not mitigate risk, as phishing domains routinely use valid certificates to appear legitimate. Users who visited or interacted with this domain should immediately revoke any connected wallet permissions and monitor transaction histories for unauthorized activity. If credentials or private keys were entered, affected wallets should be considered compromised, and all assets transferred to a new, secure wallet. It is recommended to review all connected dApps and revoke permissions via blockchain explorers or wallet management tools. No further interaction with the domain should occur, even if it appears inactive, as phishing infrastructure may reactivate or redirect to secondary malicious endpoints. Cryptocurrency users are advised to verify domain authenticity through official project channels before engaging with any token swap or recovery tools.