app[.]curves[.]eu[.]com

The domain app.curves.eu.com is identified as a cryptocurrency‑focused impersonation campaign targeting the financial brand Curve. Registration data shows the domain was created on 21 February 2026 through Instra Corporation Pty Ltd., and it is served by the CentralNIC name server cluster (ns1.centralnic.net through ns4.centralnic.net). The domain presents a valid SSL certificate labelled WE1, indicating HTTPS support, and its mail exchanger is configured to eu-com-wildcard-null-mx.centralnic.net with priority 0. DNS resolution points to 104.21.64.1, an address owned by Cloudflare, Inc. (AS13335) located in the United States.

The site has been taken offline, but historical records indicate it was actively serving malicious content before removal. Threat intelligence from multiple engines flags the domain as malicious: nine of ninety‑three VirusTotal scanners raised detections, and Gridinsoft assigns a trust score of 0 / 100. The domain appears on two public blocklists, PhishDestroy and ScamSniffer, reinforcing its classification as a crypto scam. The risk level is elevated, consistent with the brand‑impersonation and financial‑theft objectives.

Observable evidence stops at the network and registration layer; no page title, HTTP status code, or Safe Browsing verdict is available, and the content of the site has not been captured. Consequently, analysts cannot confirm the exact lure or credential‑harvesting mechanism used, only that the infrastructure aligns with known Curve‑impersonation scams. Defenders should block resolves to 104.21.64.1, add app.curves.eu.com to URL filtering and DNS sinkhole lists, and monitor for any re‑registration attempts. Ongoing surveillance of Cloudflare‑hosted subdomains and the CentralNIC name server range is advised, as the operators may reuse the same hosting profile for future campaigns.