# PhishDestroy threat dossier — send-usdc.network ================================================================ Fetched: 2026-06-30 01:46:05 UTC Canonical: https://phishdestroy.io/domain/send-usdc.network/ ## VERDICT ---------------------------------------------------------------- TAKEN DOWN (neutralised) Composite threat score: 93/100 (PhishDestroy scoring — see methodology below) ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 3/91 security vendors flagged this domain Public blocklists: listed on 3 independent blocklists ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 162.0.217.211 (NL, Amsterdam) ASN: AS22612 Namecheap, Inc. Hosting org: Namecheap, Inc. Registrar: NameCheap, Inc. Nameservers: dns1.namecheaphosting.com, dns2.namecheaphosting.com Registered: 2026-06-25 Expires: 2027-06-25 Page title: Send USDC ## TLS CERTIFICATE ---------------------------------------------------------------- Issuer: Sectigo Limited / Sectigo Public Server Authentication CA DV R36 Expires: 2027-01-10 Status: INVALID chain Fingerprint: 97618d9f4a939d375f02b830a3ee9e4e927cf960940e1e87bb02cb6732efd8b6 Subject Alternative Names (related infrastructure — often same operator): - www.send-usdc.network ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: CLOSED — no report required. This domain was neutralised before the abuse-report cycle could be dispatched — either the hosting provider / registrar suspended it on their own, the DNS went dead, or the operator abandoned the infrastructure. PhishDestroy keeps the evidence bundle on file for audit but no formal notice was sent. ## TIMELINE ---------------------------------------------------------------- Domain registered: 2026-06-25 (per WHOIS / CT — may reflect a renewal or transfer date, not first-ever registration) First detected: 2026-06-28 18:30:28 UTC (by PhishDestroy tracker) First reported: 2026-06-28 16:50:43 UTC (abuse notice filed) Last verified: 2026-06-30 00:20:34 UTC Neutralised: 2026-06-29 00:18:17 UTC Current status: taken down (registrar suspended or DNS dead) ## EXTERNAL CORROBORATION (third-party evidence) ---------------------------------------------------------------- URLScan.io: https://urlscan.io/result/019f0f10-b255-762e-b0ed-625fb8b6cf33/ URLQuery: https://urlquery.net/report/12387de5-6856-438a-94d1-ca57b74ac355 Wayback Machine: https://web.archive.org/web/*/send-usdc.network crt.sh CT logs: https://crt.sh/?q=%25.send-usdc.network Google transparency: https://transparencyreport.google.com/safe-browsing/search?url=send-usdc.network AlienVault OTX: https://otx.alienvault.com/indicator/domain/send-usdc.network URLhaus: https://urlhaus.abuse.ch/host/send-usdc.network/ ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-06-28 18:34:29 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] This domain is flagged as an active phishing site designed to intercept USDC cryptocurrency transactions. The page title, 'Send USDC,' suggests a fraudulent interface mimicking legitimate crypto transfer services, likely tricking users into sending funds to attacker-controlled wallets. The domain specifically targets individuals attempting to transfer USD Coin (USDC), a stablecoin, by presenting a deceptive transaction portal that harvests wallet credentials or misdirects payments. Analysis indicates the site may employ social engineering tactics, such as urgency or fake confirmations, to expedite unauthorized transfers before victims detect the fraud. Infrastructure analysis reveals the domain was registered on June 25, 2026, through NameCheap, Inc., and currently resolves to the IP address 162.0.217.211. Despite its recent creation, the domain has not been flagged by any of the 95 security vendors on VirusTotal (0/95 detections), indicating it may still be operating under the radar. The SSL certificate is issued by Sectigo Limited, which, while legitimate, does not guarantee the site's safety. No blocklist entries or prior reports were identified, suggesting this is a newly deployed threat vector with no prior exposure. Users who have interacted with send-usdc.network should immediately cease all activity and revoke any wallet permissions granted to the site. If funds were transferred, report the transaction to the relevant blockchain explorer and contact the wallet provider or exchange for potential recovery options. Monitor connected accounts for unauthorized activity, as phishing sites often deploy secondary payloads or credential harvesting. Security teams should add the domain and its resolving IP (162.0.217.211) to network blocklists and investigate logs for prior connections. Given the domain's recent registration and lack of detection, heightened vigilance is advised for similar USDC-themed phishing campaigns. [Updates since narrative was generated:] - Public blocklists: now listed on 3 feeds - VirusTotal detections: now 3/91 (narrative was written when count was lower) ## EVIDENCE HASHES ---------------------------------------------------------------- PhishDestroy Case ID: PD-20260628-CE392C Favicon MD5: b8a0bf372c762e966cc99ede8682bc71 TLS cert SHA-256: 97618d9f4a939d375f02b830a3ee9e4e927cf960940e1e87bb02cb6732efd8b6 ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (volunteer takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/send-usdc.network/ JSON API: https://api.destroy.tools/v1/check?domain=send-usdc.network Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: volunteer-driven open-source threat-intelligence platform. Tracked: 172,677 domains (13,021 alive under monitoring, 159,066 confirmed takedowns/dead). Site: https://phishdestroy.io