rheafinance[.]net

The domain rheafinance.net is currently active and has been identified as a high‑risk brand‑impersonation site targeting Curve. DNS resolution points to the IP address 172.67.186.50, which is hosted by Cloudflare, Inc. and geolocated to Canada. The authoritative nameservers are mike.ns.cloudflare.com and sydney.ns.cloudflare.com, indicating use of Cloudflare’s DNS service. The site presents the default Apache2 Ubuntu page titled “Apache2 Ubuntu Default Page: It works” and serves a TLS certificate issued by Let’s Encrypt (E7). Infrastructure fingerprints show Cloudflare Browser Insights and HTTP/3 support. Registration records list Fewmoretaps OU d/b/a Trustname.com as the registrar. Threat intelligence shows the domain appears on three security blocklists and is blocked by PhishDestroy, MetaMask, and SEAL. VirusTotal analysis records 15 of 91 security vendors flagging the domain, and Gridinsoft assigns a trust score of 0 out of 100. Defenders should block the domain and its resolving IP at perimeter and DNS layers, add it to threat‑intel feeds, monitor for any related infrastructure reuse, and enforce TLS inspection to detect potential credential capture attempts. Further investigation of the hosted content is required to determine the exact malicious payload or credential‑harvesting mechanisms.