curvefinance[.]uk

This domain was registered on July 23, 2026 through Dynadot, LLC t/a Dynadot. The authoritative name servers are craig.ns.cloudflare.com and marge.ns.cloudflare.com, indicating the use of Cloudflare’s DNS and likely its CDN services. DNS resolution returns the address 188.114.96.3, an IP owned by Cloudflare, which is commonly leveraged by threat actors to hide origin infrastructure. The domain is currently listed on one public security blocklist and is actively blocked by PhishDestroy, confirming that at least one defensive feed has observed malicious activity associated with it.

VirusTotal reports that the domain has been scanned by 91 AV engines, none of which have flagged it at the time of analysis; the absence of detections does not constitute a safety assurance. The site remains reachable and is marked as active. Available intelligence does not include a page title, SSL certificate details, HTTP response codes, or any observed payloads. Consequently, the precise phishing technique, targeted brand, or credential‑harvesting mechanism cannot be confirmed.

The combination of a brand‑new registration, Cloudflare front‑end, inclusion on a blocklist, and the generic phishing classification suggests a high likelihood of malicious intent, but definitive attribution requires content‑level analysis. Defenders should consider adding curvefinance.uk to existing deny‑list rules for DNS and web traffic, monitor outbound connections to the associated Cloudflare IP, and instrument URL filtering to capture any future requests. Continuous re‑evaluation of the domain through sandboxing or manual inspection is advised, as additional indicators such as malicious payloads or credential‑stealing forms may emerge. Organizations that rely on email or web gateways should ensure that their phishing detection signatures are updated to include this indicator of compromise.