usdc-eth[.]co

Analysis of usdc-eth.co indicates this domain was actively involved in cryptocurrency-related phishing activity. The domain, registered on February 5, 2025, through Gname.com Pte. Ltd., was taken offline by the time of this report on July 24, 2026. Infrastructure analysis reveals the domain resolved to IP address 172.67.132.187, hosted on Cloudflare's network (AS13335) in the United States. Nameservers adam.ns.cloudflare.com and chan.ns.cloudflare.com were in use, a common configuration for domains leveraging Cloudflare's services. No SSL certificate was detected, increasing the risk of interception or manipulation of user data.

The page title 'defi-ETH' suggests the site targeted decentralized finance (DeFi) users, specifically those interacting with Ethereum-based assets. This aligns with the scam type labeled as a 'Crypto Scam' in available threat intelligence. The domain appears on one security blocklist (PhishDestroy) and is flagged by one of 93 security vendors on VirusTotal, indicating limited but confirmed malicious activity. Additionally, AlienVault OTX lists the domain in one threat intelligence pulse, further corroborating its involvement in phishing operations.

Defenders should treat this domain as part of a broader cryptocurrency phishing campaign. While the site is currently offline, the infrastructure (e.g., Cloudflare hosting, lack of SSL) and historical activity warrant monitoring for potential reactivation or migration to similar domains. Organizations should update blocklists to include usdc-eth.co and consider retroactive analysis of logs for connections to this domain, particularly in environments where DeFi or Ethereum-related activities are common. The absence of an SSL certificate and the use of Cloudflare nameservers are notable but not exclusive to malicious domains; context from detection vendors and blocklists should guide response actions.