usdcwheel[.]cfd

This domain, usdcwheel.cfd, operates as a crypto drainer specifically impersonating the Solana blockchain platform. The site presents itself as an official Solana interface, likely tricking users into connecting wallets to execute unauthorized transactions that drain cryptocurrency assets. The fraudulent page uses the title 'Solana' to enhance legitimacy and targets users through social engineering tactics, particularly those expecting to interact with Solana-based decentralized applications or USDC-related services. Analysis indicates the domain was registered on April 22, 2026, through Web Commerce Communications Ltd. It is flagged by 12 out of 95 security vendors on VirusTotal and appears on four distinct security blocklists. Google Safe Browsing classifies the threat as SOCIAL_ENGINEERING, while infrastructure analysis reveals it previously resolved to the IP address 188.114.97.3. The domain has been referenced in one AlienVault OTX threat intelligence pulse and holds a Gridinsoft trust score of 0/100, further confirming its malicious nature. Users who visited usdcwheel.cfd should immediately disconnect any connected wallets from the site and revoke any suspicious smart contract approvals. It is recommended to check wallet transaction histories for unauthorized transfers and monitor for signs of compromised credentials. If cryptocurrency was transferred to an unknown address, report the incident to relevant blockchain analysis services and consider initiating a transaction trace. Additionally, scan local devices for malware, as some crypto drainers deploy secondary payloads to maintain persistence or harvest additional credentials.