usdcboss[.]com

This domain, usdcboss.com, is flagged as an active cryptocurrency phishing site targeting users through deceptive decentralized finance (DeFi) themes. Registered on February 21, 2026, via Gname.com Pte. Ltd., the domain resolves to IP address 188.114.96.3, hosted on Cloudflare’s infrastructure (AS13335). Analysis of its nameservers (anita.ns.cloudflare.com, jeremy.ns.cloudflare.com) and detected technologies—including Vue.js, Axios, and Cloudflare Browser Insights—indicates a modern, obfuscated front-end designed to evade detection. The HTTP 301 redirect suggests dynamic routing, a common tactic in phishing campaigns to mask malicious endpoints. The page title, 'DeFi-ETH,' aligns with known cryptocurrency scam patterns, though the exact content and mechanics of the fraud remain unconfirmed due to limited visibility. Security vendors have flagged the domain, with three out of 95 engines on VirusTotal identifying it as malicious. It is also listed on at least one security blocklist. The SSL certificate, issued by Google Trust Services (WE1), provides no inherent trust signal, as phishing domains frequently leverage valid certificates to appear legitimate. Defenders should prioritize blocking this domain at the DNS and network levels, particularly in environments handling cryptocurrency transactions. The use of Cloudflare’s infrastructure complicates takedown efforts, as the service is often exploited to hide the true origin of malicious content. Further investigation into associated wallet addresses or transaction patterns is recommended to disrupt the broader campaign. No evidence currently links this domain to a specific brand or platform beyond its thematic focus on DeFi and Ethereum.