curwe[.]fi-dapp-wailetv3[.]com

The domain curwe.fi-dapp-wailetv3.com has been classified as a high‑risk brand‑impersonation campaign targeting Curve. The site is currently active and returns HTTP 403 responses with the page title “fi-dapp-wailetv3.com | 521: Web server is down”. Analysis indicates the infrastructure is being leveraged to present a fraudulent cryptocurrency offering.

The domain was registered on 2026‑02‑21 through MAT BAO CORPORATION and is hosted behind Cloudflare (AS13335). It resolves to 172.67.152.180 and uses the nameservers jimmy.ns.cloudflare.com and lorna.ns.cloudflare.com. The TLS certificate is issued by Google Trust Services under the “WE1” label, and the service advertises HTTP/3 support. Gridinsoft assigns a trust score of 0 / 100, confirming the lack of benign reputation.

Threat intelligence shows the domain appears on one security blocklist and is actively blocked by PhishDestroy. VirusTotal reports 3 of 95 scanned vendors flagging the domain as malicious. The page content references a “fi‑dapp‑wallet” motif, consistent with reported cryptocurrency scams that mimic Curve’s branding. The combination of a low trust score, blocklist inclusion, and vendor detections aligns with the high‑risk rating.

Defenders should enforce network‑level denial of the domain and its associated IP address, and monitor DNS queries for the Cloudflare nameservers. Email filters should be tuned to detect Curve‑related impersonation cues. Incident response teams should treat any credential or wallet address submissions from this domain as compromised and advise users to delete any related communications.