crvfi[.]net

The domain crvfi.net was observed to resolve to the IPv4 address 87.120.126.210. The IP is allocated to AS215730 H2NEXUS LTD and geolocated to Germany. The hosting provider is therefore likely to be H2NEXUS. The domain was registered on 21 February 2026 through Web Commerce Communications Limited operating under the WebNic.cc brand, and uses the authoritative name servers ns100.webnic.cc and ns101.webnic.cc. The SSL certificate presented is identified as R11, indicating a self‑signed or low‑trust certificate.

Reputation services assign extremely low trust scores: Scamadviser rates the domain 1 out of 100, while Gridinsoft assigns a score of 0 out of 100. The site title retrieved from the HTTP response is “Curve Fi: The Powerhouse of DeFi Stablecoin Swaps”, which aligns with the reported scam type of a crypto‑related impersonation campaign targeting the Curve finance brand. VirusTotal analysis shows that ten of ninety‑three scanning engines flagged the domain as malicious, reinforcing the suspicion of malicious intent. The domain appears on three independent security blocklists and is actively blocked by PhishDestroy, ScamSniffer, and Enkrypt, indicating that multiple threat‑intel feeds have corroborated its malicious nature.

Current monitoring indicates the site is offline, but the infrastructure artifacts remain observable. Defenders should continue to block the IP address 87.120.126.210 and the domain name crvfi.net at DNS and proxy layers, update intrusion detection signatures to include the observed SSL fingerprint and page title, and monitor for any re‑registration attempts using the same registrar or name‑server pattern. Because the underlying hosting ASN and registrar are publicly known, threat‑hunting queries can be constructed to locate any future domains that share these attributes. At present, the evidence is sufficient to classify crvfi.net as a high‑risk crypto impersonation site.