app.alli-ai.network

Reputation services assign extremely low trust scores: Gridinsoft rates the domain 0 / 100 and Scamadviser 1 / 100. VirusTotal analysis shows that three of ninety‑five scanned security vendors flagged the domain, confirming malicious behavior despite the majority of scanners reporting no detection. The domain is listed on one public blocklist and has been added to the PhishDestroy blocklist, confirming that threat‑intel feeds consider it malicious. The overall risk rating is high and the infrastructure remains active. Evidence confirms the campaign’s objective is brand impersonation of Curve, but the exact phishing kit, credential‑collection page, or lure content has not been disclosed in the available data.

No additional indicators such as malicious scripts, redirects, or credential‑submission endpoints have been published, leaving the full attack flow uncertain. Defenders should block DNS resolution to 45.9.148.106 and add app.alli‑ai.network to URL filtering and email security policies. Monitoring for TLS certificates issued by Let’s Encrypt for this domain can provide early detection of re‑registration attempts. Continuous surveillance of the associated nameservers and the registrar NameSilo may reveal future infrastructure changes.