ad-eth-usdc1[.]top

ad-eth-usdc1.top was registered on 2025-11-17 through NameSilo, LLC and uses the Cloudflare nameservers adam.ns.cloudflare.com and chan.ns.cloudflare.com. The domain resolves to 172.67.180.115, an address owned by AS13335 Cloudflare, Inc., geolocated to the United States. No TLS certificate is presented, indicating the site was served over plain HTTP. The only visible artifact is the page title "登录 - DeFiUsdc", which references a DeFi service but provides no further content.

The site was classified as a crypto‑related phishing campaign and has been taken offline; it was blocked by the PhishDestroy sinkhole and appears on a single external blocklist. VirusTotal scanned the domain and 7 of 95 scanners flagged it, reinforcing the malicious assessment. The domain is currently inactive, and no HTTP response was observed at the time of analysis. The single blocklist entry and the modest VirusTotal detection count suggest limited distribution, but the presence of the domain on a phishing sinkhole indicates that it was actively used in credential‑stealing campaigns targeting cryptocurrency users.

Evidence of active phishing infrastructure, such as credential‑harvesting endpoints or malware payloads, was not captured, leaving the exact attack vector uncertain. Defenders should continue to block the domain at perimeter and DNS filters, monitor for any resurgence of the same host header or similar naming patterns, and enforce strict TLS inspection to prevent accidental clearance of similar unencrypted phishing sites. Threat‑intel consumers should note the association with the DeFiUsdc brand in the page title and the use of Cloudflare’s edge network, which may be leveraged by other actors to mask origin. Ongoing watch‑listing of the IP address and related Cloudflare zones is recommended.