orin[.]trade

Analysis of the domain orin.trade, observed on July 24, 2026, indicates a high‑risk brand‑impersonation campaign targeting Curve. The domain was registered on February 21, 2026 through TLD Registrar Solutions Ltd. and is hosted on the IP address 82.221.129.44, which belongs to AS50613 (Advania Island ehf) located in Iceland. The authoritative nameservers are ns1.parkingcrew.net and ns2.parkingcrew.net, typical of parked or low‑cost services. No TLS certificate is presented, and the HTTP response returns status code 200 with the page title “Orin - Trade with Confidence”, which does not reference the victim brand.

VirusTotal reports four detections out of ninety‑three scanners, and the domain appears on three public blocklists, including PhishDestroy, MetaMask, and SEAL. Gridinsoft assigns a trust score of zero out of one hundred, reinforcing the malicious assessment. The site is currently active, and its infrastructure suggests a rapid‑deployment model common to credential‑harvesting operations. While the page content has not been publicly dissected, the combination of brand impersonation labeling, the absence of encryption, low trust score, and multiple vendor detections provide sufficient confidence to classify the domain as malicious.

Defenders should block orin.trade at network perimeters, update URL filtering rules, and monitor for any authentication attempts to Curve services originating from the associated IP range. Further investigation of the hosting provider and nameserver configuration may reveal additional related domains. Continuous observation is advised to capture any evolution of the campaign.