app-curvance[.]com

The domain app-curvance.com was registered through Dynadot Inc on 17 February 2026. It resolves to the IP address 172.217.18.4, which belongs to AS15169 owned by Google LLC and is located in the United States. The site presented a TLS certificate identified as WE1, indicating that HTTPS was available at the time of observation. VirusTotal scans recorded four detections out of ninety-three submitted engines, and the domain appears on three external blocklists, including PhishDestroy, MetaMask, and SEAL.

The page title returned by HTTP queries was “Google Chrome-webbrowser”, which does not correspond to the alleged target brand. The campaign is classified as a social-media phishing operation that impersonates Facebook, as indicated by the intelligence tag “brand target: Facebook”. The current operational status is reported as offline, suggesting that the hosting has been taken down or the site is otherwise inaccessible. Analysis of the infrastructure shows no additional hosting clues beyond the Google-owned IP, and the use of a legitimate cloud provider is consistent with a pattern of leveraging reputable networks to evade network-level filters.

The modest detection count and limited blocklist presence indicate that the domain had a short exposure window before takedown, but the presence on multiple blocklists confirms that security vendors recognized the malicious intent. Defenders should continue to block the domain at DNS and proxy layers, monitor for any resurgence of the same registrar‑IP combination, and consider adding the observed TLS certificate fingerprint to internal allow/deny lists. Threat-intel feeds should be updated to reflect the confirmed Facebook impersonation, and any related URLs observed in network traffic should be investigated for credential harvesting attempts.