ethdi[.]ltd

This domain, ethdi.ltd, poses a high-risk brand impersonation threat specifically targeting Binance users through a fraudulent USDC-themed interface. Analysis indicates the domain was designed to deceive users into believing they were interacting with Binance’s legitimate USDC services, likely to harvest credentials, private keys, or initiate unauthorized transactions. The page title "USDC" directly mirrors Binance’s stablecoin offerings, increasing the likelihood of successful social engineering against cryptocurrency users. Infrastructure analysis reveals multiple technical indicators of malicious activity. The domain is flagged by 11 out of 95 security vendors on VirusTotal, and Google Safe Browsing explicitly classifies it as phishing. It appears on one security blocklist and was registered through Cloudflare, Inc., resolving to the IP address 104.21.83.13 (AS13335, Cloudflare, Inc.). Notably, the domain lacks an SSL certificate, a red flag for any site handling financial or sensitive data. The domain has since been taken offline, but its prior activity remains a documented threat. Users who visited ethdi.ltd should immediately revoke any active sessions or authorizations granted to the site, particularly those related to Binance or USDC transactions. Change passwords and API keys associated with Binance or other cryptocurrency accounts, and enable multi-factor authentication if not already active. Monitor account activity for unauthorized transactions, and report any suspicious behavior to the targeted platform’s security team. If financial data was entered, consider contacting relevant financial institutions to flag potential fraud. Given the domain’s use of Cloudflare infrastructure, users should also be cautious of similar domains leveraging the same hosting provider.