allocation-curve[.]app

This domain, allocation-curve.app, is identified as a brand impersonation threat targeting Curve, a financial services platform. Analysis indicates the site was designed to mimic Curve’s legitimate interface, likely to harvest user credentials or facilitate unauthorized transactions. No crypto drainer kit signatures were detected in initial scans, but the domain’s structure and content align with credential phishing tactics. The impersonation strategy suggests an intent to exploit trust in the Curve brand for fraudulent purposes. Technical indicators confirm elevated risk. The domain resolves to IP address 104.21.44.72, hosted on Cloudflare’s infrastructure (AS13335). VirusTotal reports 9 out of 95 security vendors flagging the domain as malicious. No SSL certificate was present at the time of analysis, increasing the likelihood of interception or manipulation of user data. The domain appears on two security blocklists: PhishDestroy and ScamSniffer. Registrar details are not publicly disclosed in available intelligence, but the page title “Just a moment...” suggests a Cloudflare proxy or mitigation response. Google Safe Browsing (GSB) status is not explicitly listed, but the domain’s presence on multiple blocklists corroborates its malicious classification. Current status indicates the domain has been taken offline, likely due to enforcement actions or hosting provider intervention. However, residual risk persists due to the potential for infrastructure reuse or domain re-registration. Users who interacted with the site should immediately revoke any active sessions, reset credentials, and monitor accounts for unauthorized activity. Organizations should update blocklists to include the domain and associated IP address. Continuous monitoring is recommended, as threat actors may attempt to repurpose the infrastructure or register similar domains for future campaigns.