curve[.]flnance[.]cldf-4app[.]top

This domain, curve.flnance.cldf-4app.top, is flagged as a brand impersonation targeting Curve, a cryptocurrency platform. It was registered on February 21, 2026, and resolved to IP address 195.20.18.201, hosted in Moldova (MD) by AVA HOST SRL (AS48753). The domain is currently offline and has been taken down by PhishDestroy.

Security analysis shows that 16 out of 93 vendors on VirusTotal flagged this domain as malicious, and it appears on one security blocklist. The SSL certificate used is R11, and the page title was 'Index of /', which is a default directory listing and not a typical phishing page, suggesting the site may have been under construction or configured to serve malicious content without a visible landing page. The exact nature of the scam, identified as a crypto scam, is not fully detailed, but the domain's association with Curve and its presence on blocklists indicate it was likely used for credential theft or wallet draining.

Defenders should block this domain and its associated IP, monitor for similar subdomains under the cldf-4app.top namespace, and review any user interactions with this domain for potential compromise. The domain's registration date and hosting location are consistent with typical phishing infrastructure, and its rapid takedown suggests active monitoring by security vendors.