curvefinance[.]co

The domain curvefinance.co is a phishing site engaged in brand impersonation targeting Curve, a decentralized exchange. It presents itself as the legitimate Curve Finance platform to deceive users into entering sensitive information, though no drainer kit was detected. As of the latest verification, curvefinance.co has been taken offline, but it previously posed an elevated risk of credential theft through its fraudulent interface.

Technical indicators confirm the malicious nature of curvefinance.co. The domain was flagged by 6 of 95 security vendors on VirusTotal, including ChainPatrol and CyRadar, and appears on 8 security blocklists such as PhishDestroy, MetaMask, and ScamSniffer. Registered through Dynadot Inc on February 09, 2026, it resolved to the IP address 130.12.180.128, hosted by Virtualine Technologies in the Netherlands. The SSL certificate was issued by Let's Encrypt (E8), and the observed page title mimicked the legitimate Curve Finance site. Technologies detected on the domain included PHP, Nginx, and OpenResty, while trust scores from Gridinsoft and Scamadviser were 0/100 and 1/100, respectively.

Users who interacted with curvefinance.co should immediately change any passwords or credentials entered on the site and enable two-factor authentication on their accounts. Monitor financial activity for unauthorized transactions and report any suspected fraud to the legitimate Curve platform. The domain can be reported to security vendors such as PhishTank or Google Safe Browsing for further investigation, and affected users may also notify their wallet providers if they connected any crypto assets to the site.