curve[.]fi-personal-wallet-connectv3[.]com

The domain curve.fi-personal-wallet-connectv3.com was registered on February 21, 2026 and is presently classified as a high‑risk brand‑impersonation campaign targeting users of the Curve financial service. The site presents a page title of “fi-personal-wallet-connectv3.com | 521: Web server is down,” indicating that the front‑end is intentionally unavailable, a common tactic to hide malicious payloads while retaining the deceptive URL.

Infrastructure analysis shows the domain resolves to the IP address 104.21.112.1, which belongs to AS13335 operated by Cloudflare, Inc., and is geographically located in the United States. The authoritative nameservers are jill.ns.cloudflare.com and rocky.ns.cloudflare.com, confirming the use of Cloudflare’s DNS service. The server advertises HTTP/3 support and returns an HTTP 403 status code, suggesting access restrictions are enforced on the web layer.

The domain is listed on two security blocklists—PhishDestroy and ScamSniffer—and has been flagged by five of ninety‑five security vendors on VirusTotal. Additional reputation metrics include a Gridinsoft trust score of 0 out of 100, reinforcing the malicious assessment. The TLS certificate is issued by Google Trust Services under the WE1 intermediate, providing a seemingly legitimate HTTPS connection that can be leveraged to gain user trust.

Current intelligence does not reveal the exact phishing page content or any captured credentials, leaving the payload and victim interaction details uncertain. Defenders should immediately block the domain and its associated IP address at perimeter firewalls and DNS resolvers, incorporate the two blocklist entries into automated threat‑intel feeds, and monitor for similar sub‑domains that reuse the same Cloudflare nameservers. User education campaigns should emphasize verification of Curve URLs and discourage entry of wallet credentials on untrusted sites.