usdcsavings[.]vip

This domain is flagged as a high-risk crypto scam designed to steal USDC wallet credentials and drain funds. Analysis indicates the site mimics legitimate USDC savings platforms, employing social engineering tactics to trick users into connecting wallets or entering private keys. The threat type is classified as a crypto drainer, with confirmed malicious activity targeting cryptocurrency holders. Infrastructure analysis reveals the domain usdcsavings.vip was registered on February 21, 2026, through Gname.com Pte. Ltd., a registrar frequently associated with fraudulent domains. It resolves to the IP address 34.143.209.240 and employs technologies including Ubuntu, Ant Design, Nginx, and Marked. The domain appears on 4 security blocklists, including MetaMask, SEAL, PhishDestroy, and InversionDNS. VirusTotal reports 3 out of 95 security vendors flagging the domain as malicious, while Google Safe Browsing classifies it under SOCIAL_ENGINEERING. The Gridinsoft trust score for this domain is 0/100, further confirming its malicious nature. The page title, USDC Savings, aligns with the impersonation of legitimate USDC-related services. Mitigation steps for this specific threat type include immediately revoking any wallet connections to the domain and auditing all recent transactions for unauthorized activity. Users who interacted with the site should transfer remaining funds to a new wallet and monitor their accounts for signs of compromise. Network-level blocking of the domain and its associated IP (34.143.209.240) is recommended to prevent further exposure. Additionally, organizations should update endpoint protection rules to detect and block similar crypto drainer domains, particularly those impersonating USDC or other cryptocurrency platforms.