curvefi[.]co

The domain curvefi.co is identified as a high-risk brand impersonation threat specifically targeting Curve, a well-known decentralized finance platform. Analysis confirms this domain was actively impersonating Curve Finance, presenting itself as a legitimate interface to mislead users into interacting with malicious smart contracts or disclosing sensitive credentials. The current status of the domain is offline, though prior activity indicates a deliberate attempt to exploit trust in the Curve brand for fraudulent purposes. Infrastructure analysis reveals the domain was registered through Dynadot LLC on May 07, 2025, and resolved to the IP address 188.114.96.3. Security assessments show 16 of 95 vendors on VirusTotal flagged the domain as malicious, while it appears on six distinct security blocklists. The Gridinsoft trust score for this domain is 0 out of 100, reinforcing its classification as a confirmed threat. Detected technologies include WordPress, MySQL, PHP, and Cloudflare services, which are commonly leveraged to obfuscate malicious activity behind legitimate infrastructure. Given the domain’s current offline status, immediate risk of active exploitation is reduced; however, the infrastructure may resurface under a different name or configuration. Users and organizations are advised to block the domain and associated IP address 188.114.96.3 at the network level. Security teams should monitor for similar impersonation attempts targeting Curve or other decentralized finance platforms, particularly those using newly registered domains or Cloudflare-hosted infrastructure. End users should verify domain authenticity through official channels before interacting with any financial service, especially those involving cryptocurrency transactions.