curve-swap[.]org

The domain curve-swap.org was registered on April 24, 2026 through Dynadot Inc and is currently active. It resolves to IP address 176.125.242.151, which is hosted by Alexhost SRL in MD and serves content over HTTPS using a Let’s Encrypt R12 certificate. The authoritative nameservers are ns1.dyna-ns.net and ns2.dyna-ns.net, and the HTTP response returns status 200 with the page title "Curve Finance | Crypto Exchange," indicating a brand‑impersonation attempt targeting Curve. Threat intelligence from AlienVault OTX references a single pulse linking this domain to brand‑impersonation activity, and VirusTotal reports 13 of 94 security vendors flagging the host. The domain appears on three public blocklists and is already blocked by PhishDestroy, MetaMask, and SEAL, while Gridinsoft assigns a trust score of 0/100. Given the high risk rating, defenders should block DNS resolution and network traffic to 176.125.242.151, add the domain to URL filtering rules, and monitor for any related indicators of compromise. Continuous observation is advised because the underlying infrastructure—particularly the hosting provider and registrar—may be reused for additional impersonation campaigns.