curve[.]finance-online-api-api-gateway-gateway[.]pro

This domain, curve.finance-online-api-api-gateway-gateway.pro, was registered on 21 February 2026 and is currently reported as taken offline. DNS resolution points to 172.67.153.6, an address owned by AS13335 Cloudflare, Inc., located in the United States. The TLS certificate presented is identified as WE1, which is typical for Cloudflare‑issued certificates and does not provide any brand‑specific validation. The HTTP response includes the page title “Access Denied”, indicating that the site is not serving a legitimate login or transaction page at the time of inspection.

VirusTotal analysis recorded two detections out of 93 scanning engines, confirming that at least a small subset of security products consider the domain malicious. The domain appears on a single public blocklist and is specifically flagged by PhishDestroy, reinforcing the suspicion that it is being used for fraudulent activity. Intelligence tags the site as a “Crypto Scam” that impersonates the Curve brand, suggesting that any URLs referencing Curve’s services could be used to harvest cryptocurrency credentials or lure victims into financial loss. Defenders should treat any network traffic to this host as high‑risk.

Blocking the IP 172.67.153.6 or the full FQDN at perimeter devices will prevent accidental user exposure. Continuous monitoring of DNS queries for the exact domain and related sub‑domains is advised, as the infrastructure could be repurposed for new campaigns. Because the site is currently offline, a definitive content analysis is unavailable; however, the combination of recent registration, Cloudflare hosting, limited VirusTotal detections, and inclusion on a phishing blocklist provides sufficient evidence to classify the domain as a malicious impersonation of Curve. Organizations should also update endpoint protection signatures to reflect the two vendor detections and verify that any credential‑capture tools targeting Curve are not being misused against this host.