curve-fi[.]vercel[.]app

This domain is flagged as a high-risk brand impersonation threat targeting Curve, a decentralized finance protocol. Analysis indicates the infrastructure is designed to deceive users into believing they are interacting with legitimate Curve Finance services, potentially facilitating credential theft or unauthorized transactions. Infrastructure analysis reveals the domain curve-fi.vercel.app was registered through Tucows Domains Inc. on February 21, 2026, an unusually future-dated creation timestamp that may indicate obfuscation techniques. The domain resolves to IP address 64.29.17.131, hosted on Amazon.com, Inc. (AS16509) infrastructure in the United States. The SSL certificate is issued by Google Trust Services (WR1), while the page title displays as a generic React App, lacking the expected branding elements of the legitimate service. Security telemetry shows 2 out of 95 vendors on VirusTotal flag the domain as malicious, and it appears on at least one security blocklist, with PhishDestroy currently blocking access. Mitigation requires immediate action from both users and network defenders. Users should verify domain authenticity by cross-referencing with official Curve Finance communication channels before interacting with any financial services. Network administrators should implement DNS-based blocking for curve-fi.vercel.app and its resolving IP 64.29.17.131 at perimeter security controls. Organizations should monitor for connections to this infrastructure in proxy logs and endpoint telemetry, particularly from devices handling cryptocurrency transactions. Given the brand impersonation nature, security teams should conduct awareness training emphasizing domain verification techniques and the risks of interacting with non-official financial service interfaces.