curvetokens[.]com

PhishDestroy first observed curvetokens.com on Aug 17, 2026. The hostname explicitly references Curve; stored content metadata identifies the same apparent target. The captured page title is “Curve Finance — Visual Shell”. Stored page analysis classifies the content as impersonation. Current evidence score: 95/100 (critical).

Positive findings are stored from 5 sources: VirusTotal, MetaMask, SEAL, Cloudflare Radar, and URLQuery. VirusTotal recorded 8 detections among 91 engines: alphaMountain.ai, CRDF, Emsisoft, Forcepoint ThreatSeeker, Fortinet, Gridinsoft, Kaspersky, Netcraft on Aug 17, 2026 at 21:20 UTC. MetaMask and SEAL listed the hostname in the separate external-blocklist snapshot on Aug 17, 2026 at 22:20 UTC. Cloudflare Radar classified the hostname as malicious and placed it in the phishing category; its verdict timestamp was not retained. URLQuery recorded 2 detections; no observation timestamp was retained. Non-positive and contextual checks: Google Safe Browsing returned no flag on Aug 17, 2026 at 19:37 UTC. URLScan completed without a malicious verdict (score 0) on Aug 17, 2026 at 23:09 UTC.

The collector marked the hostname reachable on Aug 17, 2026 at 19:31 UTC, but did not retain the HTTP response code. Registration records for the domain list Hosting Concepts B.V. d/b/a Registrar.eu as the registrar and Aug 12, 2026 as the creation date. Registration preceded first observation by 5 days. At collection time, the hostname resolved to 31.131.18.219 on AS56851 (PE Skurykhin Mukola Volodumurovuch). The recorded endpoint location is Lviv, UA. The stored server header is LiteSpeed. The evidence archive retains 2 visual captures from PhishDestroy and URLScan. TLS metadata lists Let's Encrypt as the certificate issuer with validity through Nov 10, 2026; checked Aug 17, 2026 at 22:02 UTC.

The content indicators and 5 positive source findings support the current Curve-themed impersonation classification.