usdc9[.]site

Analysis of the domain usdc9.site indicates it was a short-lived phishing infrastructure targeting users of the cryptocurrency exchange Binance. Registered on October 20, 2025, through registrar 22net,Inc., the domain resolved to Cloudflare’s IPv6 address 2606:4700:3037::ac43:93c9, hosted on AS13335 in the United States. No SSL certificate was present, increasing exposure to interception. The page title 'USDC' and scam classification 'Wallet/Seed Phishing' suggest the site was designed to harvest cryptocurrency wallet credentials or recovery phrases under the guise of a USDC-related service. As of July 24, 2026, the domain is offline and appears on one security blocklist (PhishDestroy).

Thirteen of 95 security vendors on VirusTotal flagged the domain prior to takedown, reinforcing its malicious classification. The absence of an SSL certificate, combined with a trust score of 0/100 from Gridinsoft, further supports its fraudulent nature. Cloudflare nameservers (rajeev.ns.cloudflare.com, saanvi.ns.cloudflare.com) were used, a common tactic to obscure hosting origin and complicate abuse reporting. Defenders should treat this domain as confirmed malicious infrastructure.

Although currently offline, the registration age and detection history indicate it was operational for at least several months. Security teams are advised to block the domain, IP, and associated nameservers in perimeter defenses. If the domain reappears, it should be re-evaluated for continued abuse. The exact content and functionality of the phishing page remain unconfirmed, but the available evidence aligns with known wallet credential theft patterns targeting Binance users.