usdcduihuan[.]com[.]cn

The domain usdcduihuan.com.cn is a phishing site engaged in brand impersonation targeting Coinbase users. It presents itself as a cryptocurrency exchange platform, specifically for USDC swaps, to deceive victims into disclosing login credentials or transferring funds. No drainer kit was identified, but the site poses an elevated risk due to its fraudulent representation of a legitimate cryptocurrency service. As of the latest verification, usdcduihuan.com.cn has been taken offline.

Technical indicators confirm the malicious nature of usdcduihuan.com.cn. The domain was flagged by 2 of 95 VirusTotal security vendors, including SOCRadar and Webroot, and is listed on Google Safe Browsing for 'SOCIAL_ENGINEERING'. It appears on 1 security blocklist (PhishDestroy) and was registered through 阿里云计算有限公司（万网） on November 03, 2025. The domain resolves to IP address 156.242.208.91, hosted in Hong Kong (AS132839 POWER LINE DATACENTER), and uses an SSL certificate issued by Let's Encrypt / R13. The observed page title was 'USDC兑换', and the site employed technologies such as Bootstrap, Nginx, and jsDelivr. Gridinsoft assigned a trust score of 0/100 to usdcduihuan.com.cn.

Victims of usdcduihuan.com.cn should immediately change any compromised credentials, particularly for Coinbase or other cryptocurrency accounts. Enable two-factor authentication (2FA) on all financial and crypto-related services to prevent unauthorized access. Monitor accounts for suspicious transactions and report any fraudulent activity to the affected platform. Users can report the phishing domain to Google Safe Browsing, PhishTank, or their local cybercrime unit to aid in takedown efforts.