curve-fi-dex-faq-en[.]typedream[.]app

Analysis of curve-fi-dex-faq-en.typedream.app shows an elevated‑risk brand impersonation campaign targeting Curve users. The domain is hosted behind Cloudflare (ASN 13335) and resolves to IP 188.114.97.3, a Cloudflare edge node located in the United States. The site was served over HTTPS using a Google Trust Services certificate issued to *.typedream.app, indicating that the underlying hosting platform is Typedream, a low‑code website builder. Automated fingerprinting detected a stack comprising Node.js, React, Next.js, Google Cloud services, and Cloudflare Browser Insights, which is consistent with a generic web application rather than a proprietary Curve infrastructure.

VirusTotal scans returned ten positive detections out of ninety‑five scanners, and the domain is listed on one public blocklist and has been actively blocked by PhishDestroy. Scamadviser assigns a trust score of 11 out of 100, reinforcing the low credibility assessment. The page title "Curve Finance Dex: Low‑Slippage Stablecoin Exchange" directly references Curve Finance, confirming the intent to masquerade as an official Curve service. HTTP response code 404 indicates that the page is currently offline, which aligns with the reported status of being taken down.

However, the lack of a live payload prevents verification of specific content such as login forms or malicious payloads. Defenders should continue to block the domain at network perimeter and DNS layers, update intrusion‑detection signatures to flag the observed technology fingerprint and the exact domain string, and monitor for new subdomains or similar Typedream‑hosted sites that reuse the same branding language. Threat intelligence feeds should be refreshed to capture any re‑registration attempts, and incident response teams should treat any future traffic to this domain as hostile, especially when associated with crypto‑related user credentials or wallet addresses.