curveswap-io[.]typedream[.]app

On July 24, 2026, the domain curveswap-io.typedream.app is flagged for brand impersonation, specifically targeting Curve, a well-known DeFi platform. The domain has been taken offline, and it is currently resolving to a 404 HTTP status, indicating that the site is not accessible. However, the offline status does not guarantee the domain's safety, as it could be reactivated or redirected at any time. The page title found for this domain, '𝐂𝐮𝐫𝐯𝐞 𝐅𝐢𝐧𝐚𝐧𝐜𝐞¯ | 𝐇𝐨𝐦𝐞 𝐎𝐟𝐟𝐢𝐜𝐢𝐚𝐥 𝐒𝐢𝐭𝐞', closely mimics the official branding of Curve, which is a common tactic used in phishing attacks to deceive users.

The domain's infrastructure includes the use of Node.js, React, Google Cloud, Next.js, Google Cloud Trace, Google Cloud CDN, Cloudflare Browser Insights, and Cloudflare, technologies that can be leveraged to create a convincing and functional phishing site. The SSL certificate is issued by Google Trust Services / WE1, which could add to the credibility of the site in the eyes of unsuspecting users. The domain has a low trust score of 11/100 according to Scamadviser, further indicating its potential risk. It is also listed on one security blocklist and is blocked by PhishDestroy, a security service designed to mitigate phishing threats.

The IP address 188.114.97.3 is associated with Cloudflare, Inc., located in the United States (ASN 13335). While the domain is currently offline, cybersecurity analysts recommend that defenders continue to monitor it for any signs of reactivation. Additionally, users and organizations should be vigilant and verify the authenticity of any Curve-related links or communications to avoid falling victim to a phishing attack. The exact content and operational details of the site have not been fully analyzed, but the available evidence strongly suggests that it posed a significant threat as a crypto scam designed to impersonate Curve.