usdc-eth[.]pro

usdc-eth.pro is currently offline, but historical data indicates it was used for a cryptocurrency liquidity‑farming phishing campaign. The site served a page titled “Cryptocurrency Liquidity Farming”, suggesting an attempt to lure victims into a crypto‑related investment or yield‑farming scheme. The TLS certificate was issued by Google Trust Services under the WE1 trust profile, showing a valid HTTPS configuration despite the malicious intent. Hosting was provided by CTG Server Limited in Hong Kong (AS152194) and the domain resolved to 121.127.253.110.

Nameserver records point to ns37.domaincontrol.com and ns38.domaincontrol.com, typical of GoDaddy’s DNS service. Infrastructure fingerprints include Cloudflare CDN with HTTP/3 enabled, indicating use of modern delivery mechanisms to improve performance or evade detection. VirusTotal scans recorded two detections out of 95 security vendors, confirming that at least a minority of scanners flagged the domain as malicious. The domain appears on two public blocklists, PhishDestroy and ScamSniffer, and is listed by security‑blocking services.

Registration was performed through the MEGA‑II registrar, reinforcing the attribution to the AS152194 network. Evidence is limited to the page title and the listed technical attributes; no additional content analysis is available because the site is no longer reachable. Analysts should continue to block the IP address 121.127.253.110 and the associated ASN, monitor for new domains registered with the same registrar or nameservers, and update detection rules to flag any future sites presenting the “Cryptocurrency Liquidity Farming” title. Network‑level controls that enforce DNS filtering against the known blocklists will reduce exposure, and security teams should educate users about unsolicited crypto‑investment offers that reference liquidity farming.