cubextrade[.]com

Analysis of the domain cubextrade.com reveals a confirmed brand impersonation campaign targeting the cryptocurrency platform Curve. The domain was registered on November 9, 2024, through NameCheap, Inc., a registrar frequently associated with malicious infrastructure. At the time of assessment, the domain resolved to the IP address 188.114.97.3, hosted on Cloudflare's network (AS13335) in the United States. No SSL certificate was detected, increasing the likelihood of interception or manipulation of user data.

The page title, 'Buy/Sell Bitcoin, Ether and Altcoins | Cryptocurrency Exchange | CubexTrade,' explicitly mimics the branding and service offerings of legitimate cryptocurrency exchanges, aligning with the reported scam type of crypto fraud. Detection metrics indicate limited but targeted flagging: three of ninety-five security vendors on VirusTotal identified the domain as malicious, while it appears on at least one security blocklist. Additional trust assessments, including Scamadviser and Gridinsoft, uniformly assign the lowest possible scores (1/100), reinforcing its classification as high-risk. Infrastructure analysis shows the domain was taken offline by July 22, 2026, though historical resolution to Cloudflare suggests prior operational use.

The use of a single nameserver may indicate cost-cutting or evasion tactics, common in short-lived phishing campaigns. Defenders are advised to block the domain and its associated IP at the perimeter, monitor for related domains registered through the same registrar, and alert users to the specific threat of cryptocurrency exchange impersonation. Further investigation into the hosting provider's logs may uncover additional linked infrastructure or victim interactions, though such data is not currently available.