curve-finance-defi-us[.]typedream[.]app

Analysis indicates that the domain curve-finance-defi-us.typedream.app was provisioned via the Typedream registrar and resolves to 104.21.37.85, an address owned by Cloudflare (AS13335) located in the United States. The site presented a TLS certificate issued by Google Trust Services under the WE1 root, confirming the use of Google’s certificate authority. An HTTP request returned a 404 status, suggesting that the expected content is no longer served. The page title observed in prior captures reads “Curve Finance DeFi: Stablecoin Liquidity Protocol,” aligning with the declared brand target of Curve and the classification as a crypto‑related scam.

VirusTotal records show that eleven of ninety‑five scanning engines flagged the domain, indicating a moderate level of detection across independent scanners. Additional reputation signals include a Scamadviser trust score of 11 out of 100 and inclusion on a single security blocklist, where the domain is listed by PhishDestroy. The technology stack identified consists of Node.js, React, Next.js, Google Cloud services, Cloudflare CDN, and Webpack, all typical of modern web applications but not themselves indicative of malicious intent.

The observable evidence confirms brand impersonation and a crypto‑scam profile, yet the current offline status prevents direct verification of malicious payloads or credential‑phishing pages. Defenders should continue to block the domain at perimeter controls, monitor DNS queries for the associated IP address, and consider adding the domain to internal blacklists. Ongoing observation of the IP range owned by Cloudflare is advisable, as the infrastructure could be repurposed for future campaigns targeting Curve users or other DeFi platforms.