curvefinance[.]at

Analysis of the domain curvefinance.at confirms active brand impersonation targeting Curve Finance, a decentralized finance (DeFi) stablecoin exchange. As of July 12, 2026, the domain remains operational with a page title matching the legitimate Curve Finance platform: 'Curve Finance — DeFi Stablecoin Exchange.' The site is flagged by three security blocklists, including PhishDestroy, MetaMask, and SEAL, and holds a trust score of 0/100, indicating high-risk classification. Infrastructure analysis reveals the domain resolves to IP address 209.74.82.247, hosted on AS22612 (Namecheap, Inc.) in Singapore. The domain is registered through Hosting Concepts B.V. (Registrar.eu) and utilizes nameservers a.dnspod.com, b.dnspod.com, and c.dnspod.com. The SSL certificate is issued by Let's Encrypt (YR1), a common choice for both legitimate and malicious sites. Detected technologies include Nginx, and the site returns an HTTP 302 redirect status, which may indicate an attempt to forward visitors to another malicious endpoint. VirusTotal reports three security vendors flagging the domain, though the specific nature of these detections is not detailed in available intelligence. The exact content and functionality of the site remain unanalyzed, as no direct inspection of the page has been conducted. Defenders should treat this domain as high-risk infrastructure and prioritize blocking or monitoring access to it. Given the domain's association with known blocklists and its impersonation of a DeFi platform, it is likely designed to harvest credentials, private keys, or facilitate fraudulent transactions. Further investigation into associated IP ranges and redirect chains is recommended to identify additional malicious infrastructure.