usdclayer[.]com

Analysis of usdclayer.com shows a newly registered domain (created 26 December 2025) that was hosted on a Hetzner Online GmbH server in Germany (ASN 24940) and resolved to IP 116.202.233.39. The site presented the page title “USDC Layer – Hash & Earn USDC”, suggesting a cryptocurrency‑related lure. No TLS certificate was observed, meaning the site operated without HTTPS protection. The domain was registered through NameSilo, LLC and uses the authoritative nameservers dns1.harmonweb.net and dns2.harmonweb.net.

Security‑vendor scans on VirusTotal recorded 14 detections out of 93 scanners, indicating a measurable level of malicious confidence. Independent threat‑intel feeds corroborate the risk: the domain appears on one blocklist, is listed in a single AlienVault OTX pulse, and has been blocked by the PhishDestroy service. The current HTTP status is offline, which may be a temporary takedown or a deliberate removal to evade detection.

While the exact phishing kit or credential‑harvesting mechanism has not been publicly disclosed, the convergence of recent registration, lack of encryption, multiple vendor flags, and inclusion on blocklists strongly points to a fraudulent operation targeting users seeking USDC earnings. Defenders should continue to block the domain at network perimeter devices, monitor the associated IP address for re‑hosting activity, and update any URL filtering lists with the domain and its nameservers. Analysts should also watch for re‑registration attempts or similar domains using the “USDC Layer” branding, as threat actors often recycle infrastructure after takedowns.