usdcey[.]com

On 23 July 2026, usdcey.com was identified as an elevated‑risk brand‑impersonation site that targets Binance users through wallet/seed phishing. The domain was registered on 25 October 2025 via eName Technology Co.,Ltd. and resolves to the Cloudflare address 172.67.167.251 located in the United States under ASN 13335. The authoritative nameservers are rajeev.ns.cloudflare.com and saanvi.ns.cloudflare.com. No TLS certificate is present, indicating that the site was served over plain HTTP before being taken offline.

The page title returned by the HTTP response is “USDC”, which aligns with the phishing lure of stable‑coin wallets. VirusTotal analysis shows that 13 of 95 security engines flagged the domain as malicious, and the site appears on a single security blocklist. PhishDestroy has also listed usdcey.com as blocked. The Gridinsoft trust score is 0 out of 100, reinforcing the malicious assessment.

The site explicitly impersonates Binance, aiming to harvest wallet seeds from unsuspecting users. While the exact HTML content has not been captured, the combination of brand targeting, lack of SSL, low trust score, and multi‑engine detections provides strong evidence of a functional phishing infrastructure. Defenders should add usdcey.com and its resolving IP 172.67.167.251 to deny‑list filters, monitor for new domains using the same registrar or nameserver patterns, and enforce strict TLS‑only policies for Binance‑related traffic. Continuous threat‑intel feeds should be consulted for any resurgence, and any related traffic should be investigated for credential or seed extraction attempts.