fun-community[.]live

This domain, fun-community.live, is actively flagged as a high-risk brand impersonation site targeting Curve Finance, a decentralized finance protocol. Analysis indicates the domain was registered on March 2, 2026, through NiceNIC International Group Co., Limited, and currently resolves to the IP address 188.114.97.3. The page title, 'bǐngwǔ (丙午) - Pump,' suggests an attempt to create urgency or exploit trending topics, though the exact content and functionality of the site remain unconfirmed due to limited visibility into its operations. Infrastructure analysis reveals the use of Cloudflare, including HTTP/3 and HSTS, which are commonly employed to obscure hosting details and enhance perceived legitimacy. The domain is secured with a Let's Encrypt SSL certificate, a tactic frequently observed in phishing campaigns to evade browser security warnings. Despite these measures, the domain appears on four security blocklists, including SEAL, MetaMask, PhishDestroy, and BLP-Malware, and is flagged by 5 out of 95 security vendors on VirusTotal. Additionally, it has been included in 24 threat intelligence pulses on AlienVault OTX, further corroborating its malicious classification. The Gridinsoft trust score of 0/100 underscores the domain's lack of credibility, though the specific methods of brand impersonation—such as fake login portals, fraudulent token claims, or other deceptive tactics—are not yet fully documented. Defenders should treat this domain as an active threat, particularly for users interacting with decentralized finance platforms. Immediate actions include blocking the domain at the network level, monitoring for connections to the associated IP address, and alerting users to potential risks. Given the domain's persistence and the use of evasion techniques, ongoing vigilance is recommended to mitigate exposure.