Protocol-impersonator domain registered (typosquat)
USDD (Decentralized USD)'s assessment for RD-F-161 — scored red on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
Protocol-impersonator domain registered (typosquat) signal — 90-day window applies (after 2026-02-17). USDD is a $1.475B stablecoin with high brand recognition; Justin Sun is a globally recognized crypto figure with active social media presence. Three lines of structural evidence: (1) Stablecoin impersonation at scale: Blockaid 2025 documented 4,200+ malicious dApps using stablecoin branding and 54,000+ fraudulent stablecoin tokens — USDD is a named high-recognition stablecoin that is actively impersonated in the broader stablecoin impersonation wave. (2) TRON ecosystem phishing infrastructure confirmed active: JustLend (shares TRON DAO / Justin Sun brand with USDD) had documented phishing infrastructure (justlend-dao.com) scoring Cat 11 red in the JustLend assessment. The TRON/Justin Sun brand cluster is actively targeted. (3) Justin Sun's SEC settlement (March 2026) created a heightened brand-exploitation window — high-profile news events drive domain registration spikes for imperson
Sources #
- URLBlockaid: Stablecoin Impersonation Threats ExpandingBlockaid — 4,200+ malicious dApps using stablecoin branding; 54,000+ fraudulent stablecoin tokens (includes USDD-class major stablecoins)retrieved 2026-05-17
- M3a process learnings JustLend Cat 11 F161process-learnings.md §justlend outcome: Cat 11 red for F161 — justlend-dao.com phishing infra active; TRON/Justin Sun brand cluster confirmed impersonation targetretrieved 2026-05-17
- Cybernews: 54,000 fake stablecoinsCybernews — 54,000 fake stablecoins documented across chains; major stablecoin brands primary targetsretrieved 2026-05-17
Methodology #
Determine whether a typosquat of the official protocol domain has been registered in the last 90 days.
See the full factor methodology and distribution across all protocols →