ww25[.]rewards-curvfinance[.]app

Analysis of ww25.rewards-curvfinance.app, observed on July 24, 2026, indicates the domain is being used for a fake airdrop phishing operation. The site was listed on a single security blocklist and is actively blocked by PhishDestroy, confirming that threat‑intel feeds recognize it as malicious. Infrastructure inspection shows the domain resolves to IP address 199.59.243.228, which is hosted in the United States under ASN 16509, the Amazon.com, Inc. network. No Transport Layer Security certificate was presented, meaning the site serves traffic over plain HTTP, a common characteristic of low‑effort phishing kits.

The page title returned by the server matches the domain name, reinforcing that the site was likely a placeholder or minimal landing page rather than a fully developed service. VirusTotal scans reported six positive detections out of ninety‑five submitted engines, providing independent corroboration of malicious intent. Additionally, Gridinsoft assigned a trust score of zero out of one hundred, reflecting an extreme lack of credibility. The underlying phishing kit has been identified as an "Airdrop Scam" kit, which typically lures victims with promises of free cryptocurrency distributions in exchange for personal credentials or wallet access.

The domain’s current status is offline, limiting direct observation of its content, but the historical evidence is sufficient to classify the domain as a confirmed phishing vector. Defenders should add the domain and its associated IP to blocklists, enforce DNS filtering, and monitor for any re‑registration attempts. Ongoing vigilance is advised, especially given the use of a reputable cloud provider that can obscure the true operator behind the malicious activity.