amltrust[.]world

Analysis of amltrust.world shows that the domain was associated with a crypto‑focused generic phishing campaign and is currently offline. The site presented the page title “AMLBot – Streamlining Compliance Checks,” which aligns with the reported scam type of a crypto scam. Technical profiling indicates the domain resolves to the IP address 63.176.8.218, an endpoint located in Germany and owned by Amazon.com, Inc. (AS16509). Hosting on Amazon’s infrastructure is common for both legitimate services and malicious actors, so the IP alone does not confirm malicious intent, but its presence in a phishing context warrants caution. The domain was registered through OVH SAS and uses the nsone.net name‑server set (dns1.p07.nsone.net through dns4.p07.nsone.net).

No SSL certificate was observed, despite the presence of HTTP Strict Transport Security (HSTS) headers, suggesting a misconfiguration that could expose traffic to interception. VirusTotal reported that one of ninety‑five scanning engines flagged the domain, indicating at least one security vendor identified suspicious behavior. Independent blocklist monitoring shows the domain is listed on a single security blocklist and has been actively blocked by the PhishDestroy service. Gridinsoft assigned a trust score of zero out of one hundred, reinforcing the low confidence in the domain’s legitimacy.

While the site is presently taken offline, defenders should assume the infrastructure may be reused or resurrected. Recommended actions include adding the associated IP address to network deny lists, monitoring for any re‑registration or DNS changes, and extending existing phishing detection rules to capture similar Netlify‑hosted sites lacking TLS. Continuous observation of the OVH registrar for new domains employing the same name‑server configuration is advisable, as attackers often reuse registration patterns. Until further evidence emerges, security teams should treat amltrust.