rheafinance[.]com

Analysis of rheafinance.com indicates an active infrastructure used for brand‑impersonation of Curve. The domain resolves to 34.196.175.210, an AWS EC2 instance in the us‑east‑1 region of the United States. Registration data shows creation on 24 December 2024 through Porkbun LLC and the site is protected by a Let's Encrypt certificate (R12). HTTP responses return 403, and the page title currently reads “RheaFinance.com For Sale | Finance domains”, suggesting the site is not serving a typical phishing landing page at the moment. Detected server components include Nginx with OpenResty, and client‑side trackers such as Statcounter, Microsoft Advertising, Google Tag Manager and Google Analytics, with HSTS enabled. The domain is listed on one security blocklist and has been blocked by PhishDestroy; Gridinsoft assigns a trust score of 0/100. No malicious payloads have been reported by external scanners, but the absence of detections does not guarantee safety. Defenders should treat rheafinance.com as a high‑confidence indicator of Curve‑related impersonation, add the domain to outbound filtering and DNS blocklists, monitor for changes in HTTP status or content, and watch for additional domains hosted on the same IP or ASN. Continuous reconnaissance is advised to detect potential evolution of the campaign.