eth[.]usdc2eth[.]xyz

This domain, eth.usdc2eth.xyz, operates as a fraudulent cryptocurrency staking platform impersonating legitimate USDC savings services. Analysis indicates the site presents a fake "USDC Savings" interface designed to trick users into connecting their wallets, enabling unauthorized transactions that drain funds from connected accounts. The threat specifically targets users of decentralized finance (DeFi) platforms by mimicking yield-bearing opportunities, a common tactic in crypto drainer phishing schemes. Infrastructure analysis reveals multiple high-confidence indicators of malicious activity. The domain is flagged by 12 out of 95 security vendors on VirusTotal, with Google Safe Browsing explicitly classifying it as phishing. It appears on one security blocklist and was registered on November 06, 2025, through Alibaba Cloud Computing Ltd. d/b/a HiChina. The domain resolves to the IP address 52.222.236.111, hosted on Amazon.com, Inc. infrastructure (AS16509) in Germany. Notably, the site lacks an SSL certificate, further reducing its legitimacy and increasing exposure to man-in-the-middle interception risks. Users who visited eth.usdc2eth.xyz should immediately revoke any wallet permissions granted to the site. Disconnect all wallet connections from unknown or suspicious decentralized applications (dApps) via wallet settings. Scan the affected device for malware using updated security software, as phishing sites may deploy additional payloads. Monitor wallet transaction histories for unauthorized transfers and report any stolen funds to the relevant blockchain explorer and exchange platforms. If personal or financial information was entered, consider updating credentials for other cryptocurrency-related accounts as a precautionary measure.