usdcrv[.]com

Analysis of the domain usdcrv.com indicates it was actively involved in a wallet and seed-phishing campaign targeting Binance users. Registered on October 21, 2025, through Porkbun LLC, the domain was taken offline by July 23, 2026, following detection by multiple security mechanisms. Infrastructure analysis reveals the domain was hosted behind Cloudflare, using nameservers anita.ns.cloudflare.com and jeremy.ns.cloudflare.com, and resolved to the IPv6 address 2a06:98c1:3120::3, associated with Cloudflare’s network (AS13335) in the United States. No SSL certificate was present, increasing the risk of interception or manipulation of user data.

Security vendors flagged the domain as malicious, with 11 out of 95 engines on VirusTotal detecting it as a threat. It also appeared on one security blocklist and was blocked by PhishDestroy. AlienVault OTX recorded the domain in a threat intelligence pulse, further corroborating its malicious intent. Gridinsoft assigned a trust score of 0/100, reinforcing its classification as high-risk.

The page title, 'USDC,' suggests an attempt to impersonate a stablecoin-related service, aligning with the scam type identified as wallet or seed phishing. While the domain is currently offline, defenders should treat any residual references to usdcrv.com as indicators of compromise. Organizations are advised to update blocklists, monitor for related domains registered through the same registrar or hosted on similar Cloudflare infrastructure, and alert users who may have interacted with the site prior to its takedown. The absence of an SSL certificate and the use of Cloudflare’s network are notable but not definitive indicators on their own; however, combined with detection by multiple security vendors and its presence on threat intelligence platforms, the evidence strongly supports its classification as a phishing domain targeting cryptocurrency users.