usdcup[.]fun

The domain usdcup.fun was registered on 15 December 2025 through PDR Ltd. d/b/a PublicDomainRegistry.com and resolves to the Cloudflare‑owned address 172.67.157.41 (AS13335, United States). The site presents a page title of “Solana”, indicating an attempt to impersonate the Solana blockchain brand, and is classified as a crypto‑scam. An SSL certificate identified as “WE1” is present, but the certificate details do not provide additional validation of legitimacy. Current network checks show the domain is offline, and the Gridinsoft trust score is 0 / 100, reflecting a lack of trust.

VirusTotal has flagged the domain in 14 of 95 security‑vendor scans, confirming that multiple vendors consider it malicious. The domain appears on a single external blocklist and is actively blocked by PhishDestroy. No further content analysis is available beyond the page title; therefore the specific malicious payload or credential‑harvesting mechanisms remain unknown. Defenders should treat usdcup.fun as a high‑confidence malicious indicator.

Immediate actions include adding the domain to DNS‑based blocklists, web‑proxy filters, and endpoint protection deny lists. Monitoring of the hosting IP 172.67.157.41 for additional suspicious domains is recommended, as Cloudflare infrastructure is shared among many unrelated sites. Given the recent creation date and the brand‑impersonation tactic, security teams should also watch for similarly named domains targeting Solana users, especially those using the “usdcup” token pattern. Continuous re‑evaluation is advised should the domain become active again or additional threat intelligence emerge.