payment-usdc-erc20[.]com

The domain payment-usdc-erc20.com has been identified as a high-risk entity, actively impersonating a well-known digital wallet brand. This domain was created on April 25, 2026, and is currently associated with the IP address 159.100.6.19. The infrastructure supporting this domain is identified as running on Nginx and OpenResty technologies, which are commonly used for web hosting. A thorough examination of security metrics reveals a concerning Gridinsoft trust score of 0 out of 100, indicating a very high likelihood of malicious intent. Additionally, the domain has been flagged by 16 out of 95 security vendors on VirusTotal, reinforcing its status as potentially harmful.

This domain appears to be actively targeting users by mimicking the brand it impersonates, which is evident from the page title that reads 'Trust Wallet.' Current intelligence indicates that it is listed on two distinct security blocklists, and it is monitored by threat intelligence sources, including AlienVault OTX, where it has been mentioned in 14 threat intelligence pulses. Furthermore, it has been reported and blocked by security solutions PhishDestroy and BLP-Malware, underscoring its malicious activities within the cybersecurity landscape.

The domain is registered through Ultahost, Inc., and employs a Let's Encrypt SSL certificate, which, while standard for secure sites, can also lend a false sense of security to users who may not be aware of the underlying threats. Defenders and organizations are advised to monitor their networks for any communications or transactions involving this domain. It is critical to implement user education regarding the risks of phishing attacks and to ensure adequate filtering measures are in place to block access to such impersonating sites. Given the active nature of this threat, vigilance is required to mitigate potential user impact.