usdcethu[.]bar

usdcethu.bar was registered through GoDaddy.com, LLC on 21 February 2026. The domain resolves to the Cloudflare edge address 104.21.25.177, belonging to AS13335 Cloudflare, Inc., located in the United States. DNS resolution uses the Cloudflare‑provided authoritative nameservers adam.ns.cloudflare.com and chan.ns.cloudflare.com. The site presents an HTTPS certificate issued by Google Trust Services under the WE1 root, indicating a valid TLS chain but offering no assurance of legitimacy.

An HTTP 301 redirect is observed, and the page title returned by the server is “defi‑ETH”, matching the declared scam type of a crypto‑related fraud. Front‑end analysis identifies Vue.js, jsDelivr, Axios, Cloudflare Browser Insights and HTTP/3, all typical of modern web stacks hosted behind Cloudflare’s CDN. Reputation scoring is extremely low: Gridinsoft assigns a trust score of 0 / 100, and the domain appears on one security blocklist, currently listed by PhishDestroy. VirusTotal scans show that 10 of 95 AV engines flag the domain, reinforcing the malicious assessment.

No additional intelligence such as OTX tags or Safe Browsing entries is available in the current feed. Given the recent registration date, the active status, the low trust score, and the presence on a phishing blocklist, the domain should be treated as a high‑risk crypto phishing vector. Defensive teams are advised to block the domain at perimeter firewalls and DNS resolvers, monitor for outbound connections to the listed IP, and update web‑filtering policies to deny any HTTP(S) request containing the “defi‑ETH” title pattern. Further investigation should focus on harvesting any payloads delivered after the redirect and on correlating inbound traffic logs for potential victim exposure.