curveficlaimer[.]xyz

The domain curveficlaimer.xyz was registered through NiceNIC International Group Co., Limited on October 31, 2025 and is hosted on the Cloudflare network (AS13335) with the IP address 104.21.71.168 located in the United States. No SSL certificate is presented, indicating that the site does not provide encrypted HTTPS connections. The page title returned from the live host is "Swap - Curve," which aligns with the claimed impersonation of the Curve brand. Google Safe Browsing categorises the site as a social engineering threat, and ten of ninety‑five VirusTotal scanners have flagged the domain as malicious, reinforcing the suspicion of a phishing operation.

The domain is listed on five independent blocklists, including PhishDestroy, ScamSniffer, Polkadot, Enkrypt, and Codeesura, and the Gridinsoft trust score is recorded as 0 out of 100, reflecting an extremely low confidence in legitimacy. The observed scam type is identified as wallet or seed phishing, targeting users who may be prompted to disclose cryptocurrency seed phrases or private keys. Current operational status shows the site taken offline, but remnants of the infrastructure remain observable through DNS records that continue to resolve to the Cloudflare edge node.

Defenders should continue to block the domain at network perimeter and DNS layers, monitor for any re‑registration attempts, and add the associated IP address to deny lists where feasible. Because the site is no longer serving content, threat hunters should focus on correlating any recent credential or seed phrase submissions that reference Curve with this domain, and investigate logs for connections to the listed IP during the active window. Continuous watch on the registrar NiceNIC and the Cloudflare ASN is recommended to detect any rapid redeployment of similar impersonation campaigns.