a[.]usdcqwe[.]com

The domain a.usdcqwe.com was registered on October 16, 2025 through NameCheap, Inc. and is hosted on Cloudflare infrastructure (AS13335) with the resolved address 172.67.143.249, a US‑based IP range. The site presents the page title "USDC" but no SSL certificate was detected, indicating the service is delivered over plain HTTP. Google Safe Browsing classifies the domain as a social engineering threat, and 11 of 95 security vendors on VirusTotal have flagged it, confirming a consensus of malicious intent. PhishDestroy has actively blocked the domain, and it appears on a single external blocklist, reinforcing the view that it is being used for phishing campaigns.

The authoritative nameservers are alan.ns.cloudflare.com and ursula.ns.cloudflare.com, both standard Cloudflare resolvers. Current status shows the domain taken offline, but the underlying infrastructure and registration remain active, allowing rapid re‑deployment if the operators choose to revive the site. While the page title suggests an attempt to impersonate the United States Digital Currency (USDC) brand, no further page content has been captured, leaving the exact lure and credential‑stealing mechanisms uncertain.

Defenders should continue to deny DNS resolution for a.usdcqwe.com, add the domain to local and upstream blocklists, and monitor the associated IP address for any future malicious payloads or related subdomains. Ongoing observation of NameCheap‑registered domains leveraging Cloudflare’s network is advised, as the combination of low‑cost registration and reputable hosting can be abused to evade detection. Network traffic to 172.67.143.249 should be logged and inspected for anomalous patterns, and any email or web gateways that reference the "USDC" title should be scrutinized for potential spoofed communications.