usdcpay[.]fun

usdcpay.fun was registered on 2025-11-06 through Hostinger Operations UAB and delegated to Vercel DNS nameservers ns1.vercel-dns.com and ns2.vercel-dns.com. The domain resolves to the Amazon Web Services IP address 64.29.17.65, which belongs to ASN 16509 (Amazon.com, Inc.) and is geolocated in the United States. No TLS certificate is presented, indicating that the site was served over plain HTTP when it was active. The page title observed during the brief offline snapshot was “$PAY”, and the campaign is classified as a brand‑impersonation targeting Ledger.

VirusTotal records show that 15 of 95 scanned security vendors flagged the domain, reflecting a moderate detection rate. The domain appears in a single threat‑intelligence pulse on AlienVault OTX and is listed on one external blocklist, with PhishDestroy confirming the block. Gridinsoft assigns a trust score of 0 out of 100, reinforcing its malicious reputation. The site is currently offline, limiting immediate network interaction, but the infrastructure details remain usable for attribution and mitigation.

Because the site is no longer reachable, the exact content and any payloads that may have been delivered cannot be verified, and the presence of additional infrastructure such as CDN endpoints or secondary IPs cannot be ruled out. Analysts should treat the lack of a certificate as a potential indicator of a hastily deployed phishing kit, and consider that the Vercel DNS configuration may be reused for future malicious domains. Defenders should add 64.29.17.65 to network‑level deny lists, monitor for any re‑registration of usdcpay.fun or similar patterns, and ensure that web filtering solutions block the domain and its associated IP. Continuous monitoring of Hostinger‑registered domains and Vercel DNS zones for similar characteristics is recommended, as is periodic re‑query of VirusTotal and other multi‑engine scanners to capture any new detections.