usdcflow[.]org

The domain usdcflow.org is confirmed as a crypto drainer phishing site targeting cryptocurrency users. Analysis indicates the domain is designed to impersonate decentralized finance (DeFi) platforms, specifically those involving Ethereum-based assets, as suggested by the page title 'DeFi-ETH.' The site is currently offline, but prior activity and infrastructure details remain relevant for threat assessment and mitigation. Infrastructure analysis reveals the domain was flagged by 7 of 95 security vendors on VirusTotal, indicating moderate but consistent detection across multiple engines. It was registered through Gname.com Pte. Ltd. on February 21, 2026, and resolves to the IP address 188.114.96.3. The domain appears on one security blocklist and has a Gridinsoft trust score of 0/100, reinforcing its malicious classification. The SSL certificate is issued by Google Trust Services, a common tactic to lend superficial legitimacy to phishing infrastructure. Detected technologies include Vue.js, jsDelivr, Cloudflare, Axios, and HTTP/3, which are frequently leveraged to create dynamic, responsive, and evasive phishing interfaces. Current status confirms the domain has been taken offline, likely due to enforcement actions or operational cessation by the threat actor. However, the infrastructure and registration details suggest potential for re-emergence under a similar or altered domain. Organizations and individuals are advised to block the domain and associated IP at the network level, monitor for related domains registered through the same registrar, and educate users on recognizing crypto drainer phishing attempts. Security teams should review logs for prior interactions with usdcflow.org and investigate any unauthorized cryptocurrency transactions linked to this domain.