usdcwg[.]com

The domain usdcwg.com was observed hosting a page titled "USDC" and is explicitly linked to a Binance brand impersonation campaign that targets cryptocurrency wallets and seed phrases. The domain was registered on October 25, 2025 through eName Technology Co.,Ltd. and resolves to the IP address 172.67.150.173, which belongs to AS13335 Cloudflare, Inc., situating the hosting infrastructure in the United States. Nameserver records show rajeev.ns.cloudflare.com and saanvi.ns.cloudflare.com, both Cloudflare‑managed, confirming the use of Cloudflare’s DNS and edge services. No SSL certificate was presented for the site, indicating that the HTTP service was either unsecured or deliberately omitted, a characteristic sometimes seen in quick‑turn phishing deployments.

Detection telemetry indicates that 12 of 95 security vendors on VirusTotal flagged the domain, and the site appears on a single external blocklist. PhishDestroy has already added the domain to its blocklist, and the Gridinsoft trust score is 0 out of 100, reflecting a high confidence of malicious intent. The site’s current status is offline, which limits active probing but does not remove the historical risk.

Defenders should continue to block the domain at network perimeter devices, update URL filtering rules to include the listed nameservers and IP address, and monitor for any re‑registration attempts or similar domains that reuse the same registration patterns. Because the page title "USDC" aligns with the targeted brand Binance, any alerts referencing Binance‑related credential or seed phrase harvesting should be correlated with this indicator. While the offline status removes immediate exposure, the combination of Cloudflare hosting, multiple vendor detections, and the specific wallet‑phishing classification warrants maintaining an elevated risk posture and ongoing surveillance for related infrastructure reuse.