Phishing sites impersonating Curve

PhishDestroy has recorded 154 phishing domains impersonating Curve since 2025-07-16, 39 of them in the last 30 days. The most used registrars are NICENIC and NiceNIC; the most common TLDs are .com and .xyz. The official Curve domain is curve.fi: any other site asking for your login or wallet is not Curve.

154
Domains, all time
39
Last 30 days
69
Online at last check
20
Confirmed takedowns

New domains in the last 90 days

2026-07-25: 02026-07-26: 02026-07-27: 02026-07-28: 02026-07-29: 12026-07-30: 02026-07-31: 12026-08-01: 02026-08-02: 02026-08-03: 12026-08-04: 22026-08-05: 02026-08-06: 02026-08-07: 02026-08-08: 02026-08-09: 12026-08-10: 02026-08-11: 02026-08-12: 02026-08-13: 02026-08-14: 02026-08-15: 02026-08-16: 02026-08-17: 12026-08-18: 02026-08-19: 02026-08-20: 32026-08-21: 02026-08-22: 02026-08-23: 22026-08-24: 12026-08-25: 02026-08-26: 02026-08-27: 02026-08-28: 02026-08-29: 02026-08-30: 02026-08-31: 02026-09-01: 02026-09-02: 12026-09-03: 02026-09-04: 12026-09-05: 02026-09-06: 02026-09-07: 02026-09-08: 02026-09-09: 02026-09-10: 02026-09-11: 02026-09-12: 02026-09-13: 12026-09-14: 12026-09-15: 02026-09-16: 02026-09-17: 12026-09-18: 02026-09-19: 32026-09-20: 02026-09-21: 02026-09-22: 02026-09-23: 02026-09-24: 02026-09-25: 02026-09-26: 02026-09-27: 22026-09-28: 02026-09-29: 22026-09-30: 02026-10-01: 22026-10-02: 02026-10-03: 02026-10-04: 02026-10-05: 02026-10-06: 02026-10-07: 182026-10-08: 02026-10-09: 22026-10-10: 02026-10-11: 02026-10-12: 02026-10-13: 112026-10-14: 12026-10-15: 02026-10-16: 02026-10-17: 02026-10-18: 02026-10-19: 02026-10-20: 12026-10-21: 02026-10-22: 0
Curve phishing domains detected per day: 60 from 2026-07-25 to 2026-10-22; peak 18.

How to tell a fake Curve site

Official domain: curve.fi.

Words most often added to the brand in reported domains: embercurve, finance, typedream, lite, swap, curvefinance, crates, distributions, api, curvefi.

  • Type the address yourself or use a bookmark; phishing links for Curve arrive through ads, search results, direct messages and fake support accounts.
  • Check the full domain before you sign in: look for extra words, hyphens, a different TLD or look-alike letters.
  • Curve will never ask for your seed phrase. Read every wallet signature: approvals, Permit and setApprovalForAll requests can hand over your assets.

Paste a suspicious address into the Homoglyph Checker or check it against the DestroyList.

Latest Curve phishing domains

The 50 most recently detected domains impersonating Curve
DomainFirst detectedStatus at last checkRegistrar
dashboard-curve.app2026-10-20OnlineNICENIC
curve-finances.com2026-10-14OfflineNICENIC
embercurvegovernances.xyz2026-10-13OnlineNICENIC
embercurvegovernance.xyz2026-10-13OnlineNICENIC
embercurve.sbs2026-10-13OnlineNICENIC
distributions-embercurve.xyz2026-10-13OnlineNICENIC
embercurvedashboards.xyz2026-10-13OnlineNICENIC
embercurve-dashboards.xyz2026-10-13OnlineNICENIC
dashboard-embercurve.xyz2026-10-13OnlineNICENIC
dashboards-embercurve.xyz2026-10-13OnlineNICENIC
curvewojak.space2026-10-13OnlineNameSilo
rewards-embercurve.fun2026-10-13OnlineNICENIC
reward-embercurve.fun2026-10-13OnlineNICENIC
hedrser.net2026-10-09OfflineDominet (HK)
babesstyle.shop2026-10-09OnlineDynadot
embercurvelaunch.xyz2026-10-07OnlineNICENIC
distributions-take-embercurve.xyz2026-10-07UnknownNICENIC
distribution-take-embercurve.xyz2026-10-07UnknownNICENIC
stake-embercurve.xyz2026-10-07OnlineNICENIC
embercurvestakes.xyz2026-10-07OnlineNICENIC
embercurve-launchs.xyz2026-10-07OnlineNICENIC
embercurve-embercurve.xyz2026-10-07UnknownNICENIC
embercurve-launch.xyz2026-10-07OnlineNICENIC
distribution-crates-embercurve.xyz2026-10-07UnknownNICENIC
crates-embercurve-distributions.xyz2026-10-07UnknownNICENIC
embercurvestake.xyz2026-10-07OnlineNICENIC
embercurvesnapshots.xyz2026-10-07OnlineNICENIC
distribution-embercurve.com2026-10-07UnknownNICENIC
crates-embercurve-distribution.xyz2026-10-07UnknownNICENIC
embercurve-stakes.xyz2026-10-07OnlineNICENIC
distributions-crates-embercurve.xyz2026-10-07UnknownNICENIC
distributions-embercurve.com2026-10-07UnknownNICENIC
fervorfinances.com2026-10-07OnlineNameSilo
oessal.com2026-10-01OfflineNameSilo
altoonacurveonline.shop2026-10-01OnlineDynadot
embercurvedashboard.xyz2026-09-29UnknownNICENIC
allocations-embercurve.xyz2026-09-29OfflineEranet
proposals-embercurve.fun2026-09-27OfflineEranet
embercurve-crates.com2026-09-27OnlineDominet (HK)
embercurves.fun2026-09-19OnlineNICENIC
curve-finance-info.com2026-09-19OfflineNAMECHEAP
embercurvereward.xyz2026-09-19UnknownNICENIC
jubjub.meme2026-09-17OnlineDynadot
claims-embercurve.fun2026-09-14UnknownNICENIC
oxicurve.info2026-09-13OnlineNameCheap
curve-flnance.click2026-09-04OfflineDynadot
vww-curve.finance2026-09-02OnlineDynadot
blop.fun2026-08-24OnlineNameCheap
curve-fl.click2026-08-23OfflineDynadot
governance-curvefinance.xyz2026-08-23OnlineNICENIC

All 154 Curve reports

Where they are registered and hosted

Registrars

  1. NICENIC37
  2. NiceNIC12
  3. PublicDomainRegistry.com8
  4. Typedream7
  5. Dynadot6
  6. Cloudflare5
  7. NameCheap5
  8. Dynadot5

Top-level domains

  1. .com33
  2. .xyz32
  3. .app14
  4. .finance7
  5. .fun7
  6. .dev5
  7. .co5
  8. .net5

Hosting networks

  1. CLOUDFLARENET, US39
  2. Cloudflare, Inc.37
  3. CLOUDFLARENET - Cloudflare, Inc., US22
  4. AS13335 Cloudflare, Inc.12
  5. Omegatech LTD8
  6. AS-HOSTINGER Hostinger International Limited, CY5
  7. GOOGLE, US2
  8. AMAZON-02, US2

Related

Data: PhishDestroy domain-report database, built 2026-10-22. Counts cover every reported domain whose stored target brand is Curve; share of all PhishDestroy reports: 0.07%.