curve-info[.]to

This domain, curve-info.to, is confirmed to host a cryptocurrency wallet drainer phishing site targeting users of Curve Finance, a decentralized finance protocol. The site employs social engineering tactics to trick visitors into connecting their crypto wallets, subsequently executing unauthorized transactions that drain funds. Analysis indicates the site mimics legitimate Curve Finance interfaces, including fake staking portals and governance pages, to appear authentic. Infrastructure analysis reveals the domain was registered on June 24, 2026, through the Government of the Kingdom of Tonga registrar, a jurisdiction frequently exploited for phishing operations due to lenient registration policies. As of the latest scan, the domain resolves to IP address 188.114.97.3 and has not been flagged by any of the 95 engines on VirusTotal. The SSL certificate is issued by Google Trust Services, providing a false sense of security to potential victims. No blocklist entries or community reports have been recorded yet, suggesting the campaign is either new or evading detection. Users who visited curve-info.to and connected a wallet should immediately revoke all active session approvals via their wallet settings and transfer assets to a new, secure wallet. Monitor transaction history for unauthorized activity and report any suspicious transactions to the relevant blockchain explorer. If credentials or private keys were entered, consider the compromised wallet permanently at risk. Security teams should add the domain and IP 188.114.97.3 to network blocklists and monitor for related infrastructure registered under the same registrar or hosting provider.