magic[.]alli-ai[.]network

The domain magic.alli-ai.network is currently active and classified as a high‑risk brand‑impersonation campaign targeting Curve. Infrastructure analysis shows the domain resolves to the IPv4 address 45.9.148.106, which is announced by AS49447 (Nice IT Services Group Inc.) and geolocated to the Netherlands. The hosting provider operates the site under the authoritative name servers ns1.ns306.parklogic.com and ns2.ns306.parklogic.com, and the TLS certificate presented is a publicly trusted Let's Encrypt certificate identified as YE2. Registration data indicates the domain was purchased through NameSilo, LLC. The web server returns HTTP status code 200, and the page title reported by the probe is "Alli || Online AI Tools," a title that does not reference the targeted brand and suggests a generic landing page.

Reputation services have recorded the domain on a single security blocklist and it is explicitly blocked by the PhishDestroy feed. VirusTotal analysis shows three of ninety‑five scanners flag the domain, confirming malicious indicators despite the majority of scanners returning clean results. The Gridinsoft trust score is 0 out of 100, reinforcing the assessment of low legitimacy.

While the visible content has not been manually inspected, the combination of brand‑impersonation labeling, low trust score, blocklist presence, and partial vendor detections strongly points to a phishing operation. Defenders should add the domain and its resolved IP to network‑level deny lists, monitor DNS queries for the associated name servers, and enforce TLS inspection to capture any credential submissions. Continuous re‑evaluation is advised, as additional detection vendors may update their verdicts and blocklist aggregators could increase coverage.