proposals-curves.network

VirusTotal analysis records 15 detections out of 93 scanning engines, reinforcing the suspicion that the domain is used for malicious purposes. The domain appears on four independent security blocklists and is explicitly blocked by PhishDestroy, Polkadot, Enkrypt, and Codeesura, demonstrating consensus among threat‑intel providers that the site is unsafe. The brand target is identified as Curve, confirming that the infrastructure is designed for brand impersonation attacks against Curve users. No additional content has been captured beyond the generic "Account Suspended" title, so the exact phishing landing page or credential‑harvesting mechanisms remain unknown.

Defenders should continue to deny network traffic to 213.111.154.75, add proposals-curves.network to local blocklists, and monitor for any resurgence of the domain or related subdomains. Users should be warned not to click links that reference this domain, and any email or messaging campaigns that claim to originate from Curve but contain the domain should be treated as fraudulent. Ongoing surveillance of the hosting ASN and the four blocklists is recommended to detect potential re‑use of the infrastructure for future impersonation campaigns.