curve-v2[.]pro

This domain, curve-v2.pro, is flagged as a high-risk brand impersonation threat targeting Curve, a decentralized finance protocol. The site masquerades as a legitimate staking platform, displaying a fabricated title referencing EigenLayer and a false total value locked (TVL) of $6.37 billion. No evidence of a crypto drainer kit was identified, but the page structure and metadata suggest an intent to deceive users into disclosing sensitive credentials or transferring assets under false pretenses. The impersonation extends to visual and textual elements designed to mimic Curve’s branding, increasing the likelihood of successful social engineering attacks. Analysis indicates concrete technical indicators of malicious activity. The domain resolves to IP address 5.252.155.177, hosted under AS200823 (MHost LLC) in Germany, and was registered on February 21, 2026, through Dynadot LLC. VirusTotal detection shows 17 out of 95 security vendors flagging the domain, while Google Safe Browsing explicitly classifies it as phishing. The domain appears on one security blocklist and is currently blocked by PhishDestroy. Notably, no SSL certificate is present, further degrading its legitimacy and exposing users to unencrypted data interception. As of the latest assessment, curve-v2.pro has been taken offline, likely in response to detection and blocking by security providers. However, the infrastructure remains a residual risk, as domains registered through the same registrar or hosted on the same IP range may re-emerge under different names. Users who interacted with the domain prior to its takedown should assume potential exposure of credentials or wallet addresses and take immediate remediation steps, including revoking token approvals, rotating passwords, and monitoring for unauthorized transactions. Organizations should update internal blocklists to include the domain and associated IP, while end-users are advised to verify all DeFi interactions through official Curve channels only.