curve-finance-dao-pools[.]com

The domain curve-finance-dao-pools.com was registered on October 10, 2025 through NiceNIC International Group Co., Limited and is presently offline. DNS resolution points to the IP address 188.114.96.3, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. The domain is served by the Cloudflare nameservers terry.ns.cloudflare.com and ximena.ns.cloudflare.com, and it does not present an SSL/TLS certificate, leaving the connection unencrypted. The public page title returned by the site is "Curve Finance - Decentralized Stablecoin Exchange & Liquidity Protocol," directly referencing the Curve brand and indicating a crypto‑related impersonation campaign.

According to the supplied intelligence, the site is classified as a Crypto Scam and explicitly impersonates Curve. Detection metadata show that four of ninety‑five VirusTotal security vendors flagged the domain as malicious, and it appears on a single external blocklist. The threat has been added to the PhishDestroy blocklist, providing an additional mitigation vector for organizations that consume that feed. Gridinsoft assigns the domain a trust score of 0 out of 100, reinforcing its malicious reputation.

While the domain is no longer reachable, the infrastructure details—particularly the use of Cloudflare’s network and the lack of TLS—remain relevant for attribution and for identifying other potential assets that may share the same hosting configuration. Defenders should ensure that any outbound connections to 188.114.96.3 are blocked or monitored, and that domain‑based filters include curve-finance-dao-pools.com across DNS, web proxy, and email security layers. Monitoring for newly registered domains using the NiceNIC registrar or similar patterns in the naming scheme (e.g., "curve‑finance‑dao‑pools") can help pre‑empt future impersonation attempts. Continuous ingestion of the PhishDestroy and VirusTotal feeds will provide early warning of any re‑appearance of this indicator.