curveflnance[.]co

On July 22, 2026 the domain curveflnance.co was observed targeting the financial‑service brand Curve. The domain was registered on 11 April 2026 and currently resolves to the IPv4 address 130.12.180.128, which is hosted in the Netherlands and attributed to Virtualine Technologies. The TLS certificate presented by the site is issued by Let’s Encrypt (certificate identifier E8), indicating the use of a free, automated certificate service. HTTP requests return a 404 Not Found page title, and the site has been taken offline at the time of analysis. Threat intelligence sources corroborate the malicious intent.

AlienVault OTX lists the domain in a single pulse, and three independent blocklists have added the host, with explicit blocking by PhishDestroy, MetaMask, and SEAL. VirusTotal scans show five of ninety‑four security vendors flagging the domain, confirming at least partial detection across the ecosystem. The campaign is classified as a brand impersonation of Curve, consistent with the observed targeting metadata. Evidence gaps remain: the specific phishing kit, payload, or credential‑harvesting page has not been captured, and no public Safe Browsing verdict is referenced in the supplied data. Consequently, defenders cannot confirm the exact user‑facing content that was delivered before the takedown.

Given the available indicators, security teams should add the IPv4 address 130.12.180.128 and the domain curveflnance.co to internal block lists, monitor for any future DNS resolution changes, and enforce TLS inspection to detect any re‑issued certificates. Network traffic to the associated hosting provider should be logged, and any attempted connections to the domain should be denied. Continuous threat‑intel feeds should be consulted for updates, especially new OTX pulses or blocklist entries that may expand the observed infrastructure.