app[.]alli-ai[.]network

On July 23, 2026, the domain app.alli-ai.network was observed hosting a brand‑impersonation campaign targeting Curve. The site returns HTTP 200 and presents the page title “Alli || Online AI Tools”, which does not reference the victim brand. DNS resolution points to the IPv4 address 45.9.148.106, which is announced by AS49447 Nice IT Services Group Inc. in the Netherlands. The domain is registered through NameSilo, LLC and uses the authoritative nameservers ns1.ns306.parklogic.com and ns2.ns306.parklogic.com. TLS is provided by a Let’s Encrypt certificate (subject YE2), indicating the site is reachable over HTTPS.

Reputation services assign extremely low trust scores: Gridinsoft rates the domain 0 / 100 and Scamadviser 1 / 100. VirusTotal analysis shows that three of ninety‑five scanned security vendors flagged the domain, confirming malicious behavior despite the majority of scanners reporting no detection. The domain is listed on one public blocklist and has been added to the PhishDestroy blocklist, confirming that threat‑intel feeds consider it malicious. The overall risk rating is high and the infrastructure remains active. Evidence confirms the campaign’s objective is brand impersonation of Curve, but the exact phishing kit, credential‑collection page, or lure content has not been disclosed in the available data.

No additional indicators such as malicious scripts, redirects, or credential‑submission endpoints have been published, leaving the full attack flow uncertain. Defenders should block DNS resolution to 45.9.148.106 and add app.alli‑ai.network to URL filtering and email security policies. Monitoring for TLS certificates issued by Let’s Encrypt for this domain can provide early detection of re‑registration attempts. Continuous surveillance of the associated nameservers and the registrar NameSilo may reveal future infrastructure changes.