curve[.]fi[.]io-o2[.]icu

This domain, curve.fi.io-o2.icu, poses as a legitimate Curve decentralized finance (DeFi) platform to deceive users into interacting with fraudulent swap interfaces. The site is designed to mimic Curve’s branding and functionality, likely aiming to trick victims into connecting wallets or entering sensitive credentials, which could lead to unauthorized access or asset theft. Analysis indicates this is a targeted brand impersonation attack, not a generic phishing attempt, given the specific replication of Curve’s swap page title and visual elements. Infrastructure analysis reveals the domain was registered on March 25, 2025, through PDR Ltd. d/b/a PublicDomainRegistry.com. It resolved to the IP address 188.114.97.3 and is currently offline. Security vendors on VirusTotal flagged the domain, with 6 out of 95 detecting malicious activity. The site appears on two security blocklists and has been blocked by multiple threat detection systems, further confirming its fraudulent nature. If you visited curve.fi.io-o2.icu or interacted with its content, immediately disconnect any connected wallets from the site. Review recent transactions for unauthorized activity and revoke any suspicious smart contract approvals. Change passwords for associated accounts and enable multi-factor authentication where possible. Monitor financial accounts for unusual activity and report the incident to relevant platforms or authorities. Users should verify domain authenticity by cross-referencing official sources before entering credentials or connecting wallets.