curve[.]lite-v1[.]sbs

This domain is flagged as an elevated-risk brand impersonation threat targeting Curve, a financial services provider. The infrastructure was designed to deceive users into believing they were interacting with legitimate Curve platforms, likely for credential harvesting or unauthorized transaction initiation. Analysis indicates the domain was operational long enough to pose a credible risk before being taken offline. Infrastructure analysis reveals the domain curve.lite-v1.sbs was registered on December 18, 2025, through NiceNIC International Group Co., Limited. It resolved to the IP address 104.21.52.187 and displayed an 'Index of /' page title, suggesting either misconfigured server settings or an attempt to evade detection by avoiding full phishing page deployment. The domain appears on one security blocklist and is flagged by 5 out of 95 security vendors on VirusTotal. Gridinsoft assigned a trust score of 0/100, further confirming its malicious classification. The domain was blocked by PhishDestroy prior to being taken offline. Mitigation steps for organizations and users include immediate blocking of the domain curve.lite-v1.sbs and its associated IP address 104.21.52.187 at the network perimeter. Security teams should review logs for connections to this domain or IP, particularly from endpoints that may have interacted with Curve-related services. Users who accessed the domain should be instructed to reset credentials for Curve accounts and monitor for unauthorized transactions. Financial institutions should implement multi-factor authentication (MFA) and transaction verification protocols to mitigate the risk of credential-based attacks. Additionally, domain registrars should be notified of the malicious registration to prevent future abuse by the same threat actors.