curpay[.]io

The domain curpay.io was registered on March 6, 2026 through GoDaddy.com, LLC and is currently resolving to the IPv4 address 40.117.254.190. The host resolves to a Microsoft-owned network (AS8075) located in the United States. The site presents a page titled “CurPay | Smart Digital Asset Tools with AVP®” and returns HTTP 200, indicating an active web service. The SSL certificate is issued by Let’s Encrypt (R13), which is commonly used by both legitimate and malicious actors.

Infrastructure analysis shows the domain is served by Microsoft’s cloud edge, as suggested by the AS8075 attribution, and uses GoDaddy’s default nameservers ns25.domaincontrol.com and ns26.domaincontrol.com. The site has been flagged by PhishDestroy and appears on a single security blocklist. Gridinsoft assigns a trust score of 0 out of 100, and VirusTotal reports a single positive detection out of 95 scanned engines, reinforcing the suspicion of malicious intent.

Evidence points to a classic generic phishing campaign: the page mimics a legitimate digital‑asset service and likely aims to harvest credentials or cryptocurrency wallet information. However, the limited number of external detections (one blocklist entry, one VT positive) leaves open the possibility that the site is newly deployed and has not yet been widely observed. No additional payloads, malicious scripts, or redirection behavior have been captured in public scans.

Defenders should block DNS resolution for curpay.io at the network perimeter and add the domain to web‑filtering deny rules. Email gateways should be configured to flag messages containing links to this domain, and SOC analysts should monitor for login attempts or crypto‑wallet connections to the site. Continuous re‑scanning of the host on VirusTotal and other sandboxes is advised to catch any later payload evolution.