curv-fi[.]app

The domain curv-fi.app is a confirmed phishing site engaged in brand impersonation targeting Curve, a financial services platform. This site was designed to deceive users into believing they were interacting with the legitimate Curve brand, likely to harvest login credentials or other sensitive information. No crypto drainer kit was identified. As of the latest verification, curv-fi.app has been taken offline.

Technical indicators confirm the malicious nature of curv-fi.app. The domain was flagged by 4 of 95 security vendors on VirusTotal, including ChainPatrol, alphaMountain.ai, and Gridinsoft, which assigned a trust score of 0 out of 100. It appears on 4 security blocklists: PhishDestroy, Polkadot, Enkrypt, and Codeesura. Registered through Web Commerce Communications Limited dba WebNic.cc on September 11, 2025, the domain resolved to the IP address 147.93.73.70, hosted by Hostinger International Limited (AS47583) in Lithuania. No SSL certificate was issued, and the observed page title was 'curv-fi.app'. Nameservers were kobe.ns.cloudflare.com and luciana.ns.cloudflare.com.

Users who interacted with curv-fi.app should immediately change any passwords entered on the site, enable two-factor authentication on their Curve account, and monitor for unauthorized transactions or account activity. If financial or personal data was exposed, report the incident to Curve’s official support team and relevant authorities, such as local cybercrime units or platforms like the FTC (ReportFraud.ftc.gov). For additional protection, consider using a password manager and reviewing account statements for signs of fraud.