# PhishDestroy threat dossier — curvefinance.uk ================================================================ Fetched: 2026-07-30 22:41:19 UTC Canonical: https://phishdestroy.io/domain/curvefinance.uk/ ## VERDICT ---------------------------------------------------------------- TAKEN DOWN (neutralised) Composite threat score: 89/100 (PhishDestroy scoring — see methodology below) Scam classification: Impersonation Targeted brand: Curve ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 6/91 security vendors flagged this domain Flagging vendors: ChainPatrol, alphaMountain.ai, CRDF, Forcepoint ThreatSeeker, Gridinsoft, SOCRadar Public blocklists: listed on 3 independent blocklists ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 188.114.96.3 (US, San Francisco) Hosting org: AS13335 Cloudflare, Inc. Registrar: Dynadot, LLC t/a Dynadot [Tag = DYNADOT] Nameservers: craig.ns.cloudflare.com, marge.ns.cloudflare.com Registered: 2026-07-23 Expires: 2027-07-23 Page title: curvefinance.uk HTTP response: 404 ## TLS CERTIFICATE ---------------------------------------------------------------- Issuer: Google Trust Services / WE1 Expires: 2026-10-21 Status: INVALID chain Fingerprint: 4c1fc09a58d332766b538054d9e38471aede37b634f67f52f4244c5db995c3d8 ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: CLOSED — no report required. This domain was neutralised before the abuse-report cycle could be dispatched — either the hosting provider / registrar suspended it on their own, the DNS went dead, or the operator abandoned the infrastructure. PhishDestroy keeps the evidence bundle on file for audit but no formal notice was sent. ## TIMELINE ---------------------------------------------------------------- Domain registered: 2026-07-23 (per WHOIS / CT — may reflect a renewal or transfer date, not first-ever registration) First detected: 2026-07-24 21:53:42 UTC (by PhishDestroy tracker) Last verified: 2026-07-30 20:20:29 UTC Neutralised: 2026-07-25 00:28:22 UTC Current status: taken down (registrar suspended or DNS dead) ## EXTERNAL CORROBORATION (third-party evidence) ---------------------------------------------------------------- URLScan.io: https://urlscan.io/result/019f95b0-482a-71ce-ab81-4d3446befeca/ Wayback Machine: https://web.archive.org/web/*/curvefinance.uk crt.sh CT logs: https://crt.sh/?q=%25.curvefinance.uk Google transparency: https://transparencyreport.google.com/safe-browsing/search?url=curvefinance.uk AlienVault OTX: https://otx.alienvault.com/indicator/domain/curvefinance.uk URLhaus: https://urlhaus.abuse.ch/host/curvefinance.uk/ ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-07-24 21:53:59 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] Is curvefinance.uk a Phishing Site? This domain was registered on July 23, 2026 through Dynadot, LLC t/a Dynadot. The authoritative name servers are craig.ns.cloudflare.com and marge.ns.cloudflare.com, indicating the use of Cloudflare’s DNS and likely its CDN services. DNS resolution returns the address 188.114.96.3, an IP owned by Cloudflare, which is commonly leveraged by threat actors to hide origin infrastructure. The domain is currently listed on one public security blocklist and is actively blocked by PhishDestroy, confirming that at least one defensive feed has observed malicious activity associated with it. VirusTotal reports that the domain has been scanned by 91 AV engines, none of which have flagged it at the time of analysis; the absence of detections does not constitute a safety assurance. The site remains reachable and is marked as active. Available intelligence does not include a page title, SSL certificate details, HTTP response codes, or any observed payloads. Consequently, the precise phishing technique, targeted brand, or credential‑harvesting mechanism cannot be confirmed. The combination of a brand‑new registration, Cloudflare front‑end, inclusion on a blocklist, and the generic phishing classification suggests a high likelihood of malicious intent, but definitive attribution requires content‑level analysis. Defenders should consider adding curvefinance.uk to existing deny‑list rules for DNS and web traffic, monitor outbound connections to the associated Cloudflare IP, and instrument URL filtering to capture any future requests. Continuous re‑evaluation of the domain through sandboxing or manual inspection is advised, as additional indicators such as malicious payloads or credential‑stealing forms may emerge. Organizations that rely on email or web gateways should ensure that their phishing detection signatures are updated to include this indicator of compromise. ## EVIDENCE HASHES ---------------------------------------------------------------- TLS cert SHA-256: 4c1fc09a58d332766b538054d9e38471aede37b634f67f52f4244c5db995c3d8 ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (operator takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/curvefinance.uk/ JSON API: https://api.destroy.tools/v1/check?domain=curvefinance.uk Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: independent open-source threat-intelligence platform. Tracked: 196,122 domains (83,627 alive under monitoring, 110,235 confirmed takedowns/dead). Site: https://phishdestroy.io