[Scam]: Fake Curve.Fi website

[Yaunfitda]

What happened: Fake and clone Curve.Fi website

Website:

Code:

https://curve.si/

Archived: https://archive.is/nPqW0

Registrant    NOT DISCLOSED
Registrar    EPAG Domainservices GmbH
IANA ID: —
URL: https://www.epag.de
Whois Server: —
Registrar Status    ok
Dates    10 days old
Created on 2020-10-21
Expires on 2021-10-21
   
Whois History  
Name Servers    DNS1.STORM-PRO.NET (has 727 domains)
DNS2.STORM-PRO.NET (has 727 domains)
DNS3.STORM-PRO.NET (has 727 domains)
DNS4.STORM-PRO.NET (has 727 domains)
   
  
Tech Contact    NOT DISCLOSED
IP Address    193.233.15.180 - -1 other site is hosted on this server

Real website: https://www.curve.fi/

[TalkStar]

They have purchased the domain cleverly and at first look "s" looks like "f". Even they are using real website url on their favicon area to make visitor believe that its the real one. I have checked their telegram and interesting thing is that they are using the link of real telegram channel.

[Yaunfitda]

What happened: Fake Curve site

Website:

Code:

https://curve.run/

Archive: https://archive.is/8kAce

Whois Record for Curve.run
Registrant    REDACTED FOR PRIVACY
Registrant Org    See PrivacyGuardian.org
Registrant Country    us
Registrar    NameSilo, LLC
IANA ID: 1479
URL: http://www.namesilo.com
Whois Server: www.namesilo.com/whois.php

(p)
Registrar Status    clientTransferProhibited
Dates    13 days old
Created on 2020-10-31
Expires on 2021-10-31
Updated on 2020-11-05    
  
Name Servers    NS1.CYBERCASTCO.COM (has 1,222 domains)
NS2.CYBERCASTCO.COM (has 1,222 domains)
   
  
Tech Contact    REDACTED FOR PRIVACY
REDACTED FOR PRIVACY,
REDACTED FOR PRIVACY, REDACTED FOR PRIVACY, REDACTED FOR PRIVACY, REDACTED FOR PRIVACY
(p) (f)
IP Address    190.97.166.32 - 8 other sites hosted on this server

[Yaunfitda]

What happened: Fake Curve Website

Website:

Code:

 https://curves.fi/

Archived: https://archive.is/4HyjE

Dates    316 days old
Created on 2020-01-11
Expires on 2021-11-01
Updated on 2020-11-02    
  
Name Servers    DORA.NS.CLOUDFLARE.COM [OK] (has 18,395,021 domains)
PORTER.NS.CLOUDFLARE.COM [OK] (has 18,395,021 domains)
   
  
Tech Contact    —
IP Address    104.28.16.195 - 545 other sites hosted on this server
   
  
IP Location    United States Of America - California - San Francisco - Cloudflare Inc.
ASN    United States Of America AS13335 CLOUDFLARENET, US (registered Jul 14, 2010)
IP History    1 change on 1 unique IP addresses over 0 years    
  
Hosting History    4 changes on 4 unique name servers over 6 years    
  
Website
Website Title    None given.    
  
Whois Record ( last updated on 2020-11-22 )

[TheUltraElite]

These impersonation domains will always be a problem with the internet era. No way to stop them except being careful and bookmarking important sites. Worse is that people often don't check sites and visit them without checking, use older browser models that don't warn on phishing sites.

They also follow the trends. Like now it's defi previously it was Libra and so on.

Good job posting it here. Hoping some people find it before getting scammed and not after.

[Yaunfitda]

What happened: Fake Curve Website

Website:

Code:

http://curves.exchange/

Archived: https://archive.is/1M3N8

Registrant    REDACTED FOR PRIVACY
Registrant Org    Data Protected
Registrant Country    ca
Registrar    Tucows Domains Inc.
IANA ID: 69
URL: http://www.tucows.com
Whois Server: whois.tucows.com

(p)
Registrar Status    clientTransferProhibited, clientUpdateProhibited
Dates    20 days old
Created on 2020-11-07
Expires on 2021-11-07
Updated on 2020-11-12    
  
Name Servers    JULE.NS.CLOUDFLARE.COM (has 18,273,647 domains)
LAKAS.NS.CLOUDFLARE.COM (has 18,273,647 domains)
   
  
Tech Contact    REDACTED FOR PRIVACY
REDACTED FOR PRIVACY,
REDACTED FOR PRIVACY, REDACTED FOR PRIVACY, REDACTED FOR PRIVACY, REDACTED FOR PRIVACY
(p) (f)
IP Address    104.31.70.180 - 537 other sites hosted on this server

[Furious 7]

Good research your friends have taken a lot of time to keep investigating this case with the same name but different domains.

And scamer always has many ways with those who want, including with Curve which continues to be the target so that the victims are sure of what they are doing, so stay alert.

Once again your work is very appreciated.

[Yaunfitda]

Good job posting it here. Hoping some people find it before getting scammed and not after.

Once again your work is very appreciated.

Thank you very much for your kind words, I will still hunt more curve scams and exposed it here so that they won't victimized our members here, hopefully.

They are targeting curve, this kind of liquidity pool are easy target for scammers because of the current hype and people might not be doing any research and perhaps can fall for this fake websites.