learn--curve-fi-defi[.]typedream[.]app

On July 25, 2026 the domain learn--curve-fi-defi.typedream.app was observed serving a HTTP 404 response while presenting the page title “Curve Fi DeFi – The Backbone of Stablecoin Liquidity in DeFi.” The site is registered through Typedream and resolves to IP address 188.114.97.3, which belongs to Cloudflare, Inc. (AS13335) and is geolocated in the United States. SSL termination is performed by Google Trust Services under the WE1 certificate chain, indicating the use of a standard Google‑issued TLS certificate. Infrastructure analysis shows the presence of Node.js, React, Next.js, Google Cloud services, Google Cloud Trace, Google Cloud CDN, Cloudflare, and Webpack, suggesting a modern web stack typical of legitimate applications but also commonly abused by malicious actors. The domain appears on one security blocklist and is specifically blocked by PhishDestroy, confirming that at least one defensive feed has flagged it as malicious.

VirusTotal scans returned detections from 10 of 95 security vendors, reinforcing the suspicion of malicious intent. The listed brand target is Curve, and the threat is classified as a brand impersonation crypto scam, implying that the site attempts to mislead users into believing it is associated with the Curve DeFi platform. The current operational status is offline, and no nameserver information is available.

While the HTTP 404 response limits immediate content analysis, the combination of blocklist inclusion, multiple vendor detections, and the use of a reputable brand’s name indicates a high likelihood of credential harvesting or financial fraud. Defenders should continue to block the domain at DNS and proxy layers, monitor for any re‑registration attempts, and audit outbound traffic for connections to the associated IP address. Incident response teams should also advise users of Curve to disregard any unsolicited communications referencing this domain and to verify authentic Curve URLs through official channels.