usd-c865[.]com

This domain, usd-c865.com, operates as a fraudulent cryptocurrency phishing portal specifically targeting users of USDC (USD Coin) digital assets. The site mimics legitimate USDC wallet interfaces to deceive victims into entering private keys, seed phrases, or login credentials, which are then harvested by threat actors for immediate fund theft. The page title explicitly displays 'USDC,' and the domain structure includes cryptocurrency-related terms to enhance credibility during social engineering attacks. Analysis indicates multiple technical indicators of malicious intent. The domain was registered on October 29, 2025, through Gname.com Pte. Ltd., an uncommon registrar for legitimate cryptocurrency services. It resolves to IP address 172.67.162.9, part of Cloudflare's network (AS13335), which is frequently abused for phishing due to its free SSL certificates and IP masking capabilities. VirusTotal reports 17 out of 95 security vendors flagging this domain as malicious, while it appears on one security blocklist. The SSL certificate is issued by Google Trust Services (WE1), a common choice for both legitimate and malicious sites leveraging Cloudflare infrastructure. Users who visited usd-c865.com should assume credential compromise and take immediate action. Disconnect any connected wallets from the internet and transfer remaining funds to a new wallet with a fresh seed phrase. Revoke all active sessions and connected dapp permissions associated with the compromised credentials. Scan local devices for malware using updated security tools, as phishing sites may deploy additional payloads. Monitor transaction histories for unauthorized transfers and report the incident to relevant cryptocurrency platforms. Future interactions with cryptocurrency services should verify domain authenticity through official channels before entering sensitive information.