Is treasurypools-curve.xyz a scam? TrustSniffer's high-risk assessment: 0/100

Security Alert

Fortinet, Kaspersky, Sophos flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

This website is a decentralized-finance-style portal on a recently created ".xyz" domain. Its name, "treasury pools" paired with "curve", evokes the vocabulary of crypto liquidity pools and yield products. When captured, the homepage returned a security interstitial titled "Suspected Phishing" instead of site content, and the site's own content could not be examined. Its apparent purpose, judging from the domain branding alone, is to invite visitors to deposit or connect assets to a pool-based crypto service.

Scam/Impersonation Risk

This is a high-risk site with confirmed adverse external reputation. Several major security vendors independently classify the domain as malicious, and a further one rates it suspicious. That volume of detections is a confirmed blacklisting, not an isolated false positive. When the homepage was fetched, the front-line protection layer replaced the content with a "Suspected Phishing" warning page. This corroborates the vendor detections. The domain name also borrows well-known decentralized-finance terminology, which is a common lure pattern for credential and wallet-theft campaigns. No conflicting legal identities were observed, and the sandbox saw no wallet-drainer behavior, clipboard hijacking, or hidden credential forms. These clean behavioral results do not offset the blacklisting. The page behind the warning was not captured, so a drainer could be served to real visitors without having been observed. Behavioral testing also showed heavy outbound traffic: most requests went to third-party hosts, with dozens of external fetch calls, several external POST submissions, and a large number of console errors. This is consistent with a script-heavy front end that exchanges data with many outside services. Combined with the blacklisting and the very young domain, this pattern calls for strong caution. Evidence:

• Homepage capture: replaced by a "Suspected Phishing" interstitial, with only a short text body retrievable.
• Reputation check: 11 malicious and 1 suspicious detections, including three leading security vendors, with the blacklist threshold for automatic downgrade reached.
• Sandbox behavior (3 runs): 35 external XHR/fetch calls, 9 external POSTs, up to 95.7% of requests external, 30 console errors, and no wallet-provider or drainer activity detected.
• Registration: domain created 2026-07-07 (~0.3 years old), registered through PDR Ltd. d/b/a PublicDomainRegistry.com in the name of an individual, Silas Morales, with no organization listed.

Regulatory Verification Notes

The captured page exposed no legal, terms, or about content, so no company name, license, registration number, or jurisdiction could be assessed. Nothing on the site supports any claim of regulated or supervised status, and no third-party broker database entry matched this domain. The absence of a regulator link is not itself evidence of wrongdoing. Here, however, the missing disclosures coincide with confirmed adverse reputation, and nothing offsets them. The domain's technical hygiene is ordinary. It presents a valid but basic domain-validated certificate, which proves control of the domain and says nothing about the operator's identity or intent. The WHOIS record is complete, but it names only a private individual, with no organization, and cannot be tied to any known brand. Evidence:

• Transport security: TLS certificate issued by WE1 (DV), valid to 2026-12-03, with 37 days remaining at analysis time.
• Hosting: served from AS13335 (Cloudflare, Inc., US), with the registry shown as ARIN.
• Third-party broker databases: no match found for the domain.
• Legal pages: none captured, so no entity name, license number, or jurisdiction is available.

What to Verify Next

No interaction with this site should be started until the external detections are cleared. A prospective user who arrived through an advertisement, message, or social post should locate the genuine service independently, using an official listing or a project's verified channels. They should not use any link supplied by this domain. The real project's own documentation should be checked to confirm whether it operates any "treasury pool" product at all. Any claim of an operating entity or license should be checked against the relevant registry. The official support or contact channels of the legitimate project should be confirmed through an independent, offline route. If a wallet was already connected or credentials were entered, token approvals should be revoked and passwords changed immediately. Evidence:

• The security interstitial and the number of independent vendor detections both indicate the site should not be treated as a legitimate venue.
• No legal or licensing information was available on the captured page to check against any registry.
• The domain is only about three months old, so it has no long operating record to corroborate any claim to be an established project.

Summary Verdict

The overall posture is critical and clearly cautionary. Confirmed multi-vendor malicious classification, the phishing interstitial, and a registration history of only a few months converge on a high likelihood of harm to visitors. Absence of observed drainer behavior and standard technical hygiene do not change the posture. Sensitive interactions of any kind (login, credential entry, wallet connection, or payment) are unsafe.

Infrastructure Integrity

The site sits behind Cloudflare's CDN and WAF, and every resolved address is a Cloudflare edge address. The origin server was not visible, so independent verification of the real hosting is not possible. Edge-only visibility can also mask rapid content swaps behind a stable front end. The protection is a mitigating factor only. It filters bot traffic, but it does not vouch for the content or the operator, and it cannot offset the confirmed reputation risk. The valid certificate and trusted edge network indicate competent configuration, not legitimacy.

Closing Assessment

Do not log in, connect a wallet, approve transactions, or send funds or personal data to this site. If it must be examined for research, use an isolated, disposable environment with no linked accounts or assets. Anyone who has already interacted with it should treat their wallets and credentials as potentially compromised and act accordingly.