autarchy.net: Brand Impersonation Targeting Curve

This domain is currently under investigation but has been flagged for brand impersonation, specifically targeting the Curve brand. The page title 'Central Finite Curve' suggests a sophisticated attempt to mimic Curve's services, potentially to harvest credentials or deploy a crypto drainer. While the site is now offline, its presence on a security blocklist and in an AlienVault OTX pulse indicates it was actively used in malicious campaigns.

The domain was created on April 28, 2026, and registered through Fewmoretaps OU d/b/a Trustname.com. It resolves to IP 104.21.14.45 and uses an SSL certificate from Google Trust Services / WE1. Despite having zero detections on VirusTotal (0/95), its inclusion in one threat intelligence pulse and one blocklist underscores the stealthy nature of this threat. The combination of a recent creation date and low detection rate highlights the need for proactive monitoring.

To defend against such brand impersonation threats, organizations should implement strict email filtering rules to block domains that mimic legitimate brands, deploy browser isolation for high-risk sites, and educate users to verify URLs carefully. For Curve specifically, users should only access the official website directly and report any suspicious domains to the security team. Regular threat intelligence feeds should be monitored for new impersonation domains, and any confirmed phishing sites should be added to blocklists immediately.