a[.]usd-coin[.]top

The domain a.usd-coin.top is identified as a brand impersonation threat specifically targeting the Base cryptocurrency platform. Analysis confirms this domain was designed to deceive users by mimicking legitimate decentralized finance (DeFi) services, as indicated by its page title, DeFi-USD Coin. The domain is currently offline, but prior activity suggests it was operational for malicious purposes. Technical indicators reveal multiple red flags. The domain was flagged by 13 of 95 security vendors on VirusTotal, registered through Gname.com Pte. Ltd. on March 01, 2025, and resolved to the IP address 172.67.129.18. It appears on one security blocklist, and its infrastructure leverages Cloudflare, Vue.js, jsDelivr, Axios, and HTTP/3. The SSL certificate is issued by Google Trust Services, while the Gridinsoft trust score is 0/100, reinforcing its malicious classification. The domain was also blocked by PhishDestroy, further validating its fraudulent nature. Given the domain's current offline status, it may resurface under a different name or infrastructure. Organizations and users are advised to monitor for similar impersonation attempts targeting Base or related DeFi platforms. Block the domain and its associated IP (172.67.129.18) at the network level, and update detection rules to include the observed technologies (Vue.js, Axios, HTTP/3). Security teams should review logs for connections to this domain or IP prior to its takedown and conduct user awareness training on recognizing brand impersonation in crypto-related phishing campaigns.