usdccs[.]de

This domain, usdccs.de, is flagged as a generic phishing threat with an elevated risk level, reported on July 23, 2026. According to intelligence data, the domain resolves to the IP address 104.21.75.69, which is hosted in the United States under AS13335 (Cloudflare, Inc.), and uses Cloudflare technologies along with nameservers johnathan.ns.cloudflare.com and perla.ns.cloudflare.com. The SSL certificate is issued by Google Trust Services / WE1. The page title at the time of analysis was 'USDC Savings', suggesting the domain was designed to impersonate or reference the USDC stablecoin savings platform for credential or financial theft.

The HTTP status returned a 403 Forbidden, which may indicate active blocking or the site being taken offline. VirusTotal scans from 93 security vendors show 14 detections for this domain, confirming its malicious nature. Additionally, the domain appears on one security blocklist and is blocked by PhishDestroy. AlienVault OTX indicates the domain is found in one threat intelligence pulse, further corroborating its association with phishing campaigns.

The domain is currently offline, but defenders should be aware that similar phishing domains often re-emerge under different top-level domains or slight name variations. It is uncertain whether the domain targeted specific user groups or had a broader distribution, as no detailed campaign infrastructure or email sample data is available. Security teams are advised to monitor for related domains using the 'USDC Savings' page title pattern, block the IP 104.21.75.69 and associated Cloudflare infrastructure where appropriate, and ensure end-users are educated about verifying URL authenticity for financial platforms. No other hosting provider or registrar information is available in the supplied intelligence.