ww25[.]rewards-curvfinance[.]com

This domain ww25.rewards-curvfinance.com was observed hosting a fake airdrop phishing kit. The site resolves to the IP address 199.59.243.228, which belongs to Amazon.com, Inc. (AS16509) and is geolocated in the United States. The domain was created on 2024-10-09 through OwnRegistrar, Inc. and is served by four authoritative nameservers: ns1.managedns1.com, ns2.managedns1.com, ns1.priv4sys.com.iwantdemo.com, and ns2.priv4sy. No TLS certificate is presented, indicating that the site was reachable only via HTTP.

The page title returned by the server is "rewards-curvfinance.com", matching the domain label but providing no further brand context. Gridinsoft assigns a trust score of 0 out of 100, and the domain is listed on at least one public security blocklist. VirusTotal reports that 11 of 95 scanning engines flagged the domain as malicious, and PhishDestroy has already taken the site offline. The lack of an SSL certificate, the low trust score, and the presence of a known airdrop phishing kit collectively suggest a high likelihood of credential‑harvesting activity targeting cryptocurrency users.

Uncertainty remains regarding any active command‑and‑control infrastructure because the site is currently offline, and no additional payload details have been captured. Defenders should add the fully qualified domain name and its resolving IP address to outbound and inbound blocklists, monitor DNS queries for the listed nameservers, and enforce strict TLS inspection policies to prevent accidental HTTP fallback. Continuous scouting of the associated Amazon IP range for new payloads is recommended, as threat actors frequently recycle cloud instances. Organizations should also educate users about unsolicited airdrop offers and advise verification against official communication channels.