Is curve-finance-w3.web.app a scam? TrustSniffer's high-risk assessment: 0/100

Security Alert

Kaspersky flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

This website is a single-page decentralized-exchange style interface titled "Swap - Curve", published under a subdomain whose name borrows the Curve Finance brand. The homepage presents a token-swap front end with very little supporting text, and it appears to be a web application for routing token trades rather than an informational or commercial site. Its purpose is not independently attributable to any verified operator.

Scam/Impersonation Risk

This site carries an elevated risk assessment, driven by external security detections rather than by anything visible in its page content. It is blacklisted by external threat-intelligence sources. Five independent security engines currently flag it as malicious, including one tier-one security vendor, and that convergence is the decisive factor. No identity contradiction, conflicting legal entity, or confirmed brand-impersonation finding was recorded. The assessment therefore rests on the detections and on the combination of a swap interface, a name that evokes an established DeFi protocol, and an unverified operator. The site was not matched to any recognized DeFi protocol listing, so nothing independently ties it to the genuine Curve project. Four abuse reports exist against an address used by the site, but that address is shared content-delivery infrastructure used by many unrelated sites. Those reports are therefore weak evidence about this site and are treated as context, not as an additional accusation. The behavioural sandbox found no wallet-drainer activity, clipboard manipulation, hidden forms, cloaking, or credential posts to third parties. It did record heavy outbound traffic: 54 external data requests and 7 external posts, all to destinations already considered benign. These observations do not offset the active detections, because a clean automated run cannot rule out content changes or targeted behaviour. Evidence:

• Homepage: titled "Swap - Curve", with only a short block of interface text and no accompanying product, team, or documentation content.
• Reputation: five security engines flag the domain as malicious, and the site is on an external blacklist.
• DeFi recognition: the site was not matched to any recognized DeFi protocol listing, despite the Curve naming.
• Behavioural testing: three successful runs showed no wallet-drainer, clipboard-hijack, hidden-form, or cloaking activity.

Regulatory Verification Notes

The captured page names no legal entity, operator, jurisdiction, licence, or registration, and it has no terms or privacy pages. Its operator is therefore unverified, with ownership and governance opacity present. The site is not matched to any third-party regulatory or broker record. Absence of a licence is a verification gap, not proof of wrongdoing in itself. Here it compounds the external detections, and the site's role as a financial swap interface makes the missing accountability more consequential. The transport encryption is valid, but it is a baseline hygiene measure that offers no assurance about who operates the site or what its code does. Evidence:

• Homepage: no company name, licence number, jurisdiction, terms, or privacy disclosure appears in the captured content.
• Hosting: served from AS54113 (Fastly, Inc., US).
• Transport encryption: TLS certificate issued by WR4 (domain-validated, DV only), valid to 2026-12-22 with 61 days remaining.

What to Verify Next

Anyone who believes they are looking for the genuine Curve service should obtain its address from an independent source, such as the project's official documentation or a trusted aggregator reached separately from this site, and compare it character by character with this one. It should also be checked whether the project's official channels mention this subdomain. Any claim by this site to be official should be tested against those channels, not against the site's own statements. Once the site's hosting platform allows it, a report to that platform's abuse team can confirm whether the content is under review or has been removed. Evidence:

• Domain structure: the site runs on a shared-platform subdomain, not a standalone registered brand domain.
• Brand reference: the "curve-finance" wording in the hostname and the "Swap - Curve" page title are the only brand links, and both are self-asserted.
• Page content: the thin homepage offers no verifiable team, audit, or contract information to check against.

Summary Verdict

The overall posture is high risk. Convergent external detections outweigh the benign technical hygiene and the clean sandbox behaviour observed. The operator is unverified, and the site cannot be treated as the legitimate service its branding suggests.

Infrastructure Integrity

The site is delivered through Fastly's content-delivery network, and every observed address is a shared edge node. No origin server was observable. This reflects a reputable, widely used provider and is a mitigating factor only. Edge-only visibility also prevents independent verification of the underlying host and allows content to be swapped rapidly without any visible infrastructure change. Protective infrastructure cannot offset the reputation risk established above.

Closing Assessment

The site should be treated as read-only at most. No account login, credential entry, wallet connection, transaction signing, or fund transfer should take place here, and any such interaction should be confined to an address verified through the project's official channels. Anyone who has already interacted with the site should review their wallet permissions and revoke any approvals granted.

Signals weighed against the site

• AbuseIPDB: 4 reports on hosting IP 2620:0:890::100 (Google LLC, Content Delivery Network), 3% confidence. The reports are attributed to shared infrastructure, not specifically to this website.