curve[.]fan

This domain carries an elevated risk level due to confirmed brand impersonation targeting Curve. The specific threat involves a fake login page designed to steal credentials or crypto wallet information from users expecting legitimate Curve services. Security researchers flagged this site as a phishing attempt, and it has been taken offline, but similar domains may still be active.

The domain curve.fan was registered on December 11, 2025, through GoDaddy.com, LLC, and resolves to IP address 13.248.243.5. It uses an SSL certificate issued by GoDaddy Secure Certificate Authority, which can give a false sense of security. VirusTotal analysis shows 7 out of 95 security vendors flagging this domain as malicious, and it appears on at least one security blocklist. The page title was simply 'curve.fan', which further indicates a hastily set up phishing site.

Users are strongly advised to avoid interacting with curve.fan or any similar domain. PhishDestroy recommends always verifying URLs by typing the known official website directly into the browser. For Curve services, navigate to the official domain confirmed by the company. If you have already entered sensitive information on this site, change your passwords immediately and enable two-factor authentication. Report any suspicious domains to security teams to help protect others from this threat.