crv-curve-swap[.]org

This domain, crv-curve-swap.org, is actively impersonating Curve Finance, a decentralized finance protocol known for stablecoin trading. Registered on July 19, 2025, through NICENIC INTERNATIONAL GROUP CO., LIMITED, the domain currently resolves to IP address 172.67.177.224 and presents a page titled 'ZeroLend: Decentralized Crypto Lending & Borrowing Protocol,' which does not align with Curve's branding or services. The mismatch between the domain name and the displayed content suggests an attempt to deceive users into believing they are interacting with Curve Finance while redirecting them to unrelated or malicious financial services. Analysis indicates high-risk indicators associated with this domain. Google Safe Browsing has flagged it for social engineering, and Gridinsoft has assigned it a trust score of 0 out of 100. Additionally, 15 out of 95 security vendors on VirusTotal have detected malicious activity linked to this domain. The domain appears on three security blocklists and has been referenced in 14 threat intelligence pulses on AlienVault OTX, further corroborating its association with malicious campaigns. The SSL certificate, issued by Google Trust Services, does not mitigate the risk, as legitimate certificates are commonly used in phishing operations to lend a false sense of security. Infrastructure analysis reveals that the domain is still active as of July 12, 2026, and is blocked by multiple security providers, including PhishDestroy, InversionDNS, and BLP-Malware. The domain's creation date, nearly a year prior to this report, suggests it may have been established specifically for long-term impersonation campaigns. Defenders should treat this domain as a confirmed threat and implement blocking measures at the DNS and network levels. Monitoring for similar domains using variations of 'crv' or 'curve' in their names is recommended to preempt further impersonation attempts targeting Curve Finance users.