usdcre[.]com

The domain usdcre.com was registered on 25 October 2025 via eName Technology Co.,Ltd. and subsequently resolved to the Cloudflare address 172.67.173.250, associated with ASN 13335 in the United States. DNS resolution is delegated to rajeev.ns.cloudflare.com and saanvi.ns.cloudflare.com. The site presented a page title of “USDC” but did not serve an SSL/TLS certificate, indicating the connection was unencrypted at the time of observation. Reputation metrics are uniformly negative: Gridinsoft assigned a trust score of zero out of one hundred, and twelve of ninety‑five antivirus engines on VirusTotal reported detections. The domain also appears on a single external blocklist and has been actively blocked by the PhishDestroy service.

No HTTPS certificate was observed, and the current operational state is offline, suggesting the phishing infrastructure has been taken down or is no longer reachable. Evidence points to a classic phishing campaign: the use of a recent registration, rapid deployment behind Cloudflare’s edge network, and the absence of any legitimate security credentials. However, the limited public data leaves several aspects unresolved. The specific payload or credential‑harvesting mechanism has not been captured, and the target brand beyond the generic “USDC” title is not confirmed.

Additionally, the lack of additional sandbox or sandbox‑derived artifacts prevents a detailed attribution of the threat actor behind the domain. Defenders should continue to monitor for any residual infrastructure linked to the IP address 172.67.173.250, enforce blocklist entries for usdcre.com in web filtering solutions, and ensure that any email or web traffic referencing the “USDC” brand is scrutinized for potential spoofing. Updating intrusion‑detection signatures to flag the observed nameservers and registrar information can provide early warning for future domains registered through the same registrar.