ampgila[.]store

The domain ampgila.store has been identified as a phishing site designed to impersonate a legitimate global platform, likely targeting users with fake login portals or credential harvesting schemes. Analysis indicates the site was operational until recently, employing deceptive tactics to mimic trusted services and extract sensitive information from victims. No specific brand impersonation has been confirmed, but the generic "Global Platform" page title suggests an attempt to appear as a broad, authoritative service. Infrastructure analysis reveals the domain was registered on March 02, 2026, through NameCheap, Inc., and resolved to the IP address 192.64.117.122. It is flagged by 5 of 95 security vendors on VirusTotal, with detections from multiple threat intelligence sources. The domain appears on two security blocklists, including PhishDestroy and OISD, and has a Gridinsoft trust score of 0/100. Technologies detected include PHP and LiteSpeed, while the SSL certificate is issued by Sectigo Limited, a common choice for both legitimate and malicious sites. The creation date, registrar, and hosting infrastructure align with patterns observed in phishing campaigns, where short-lived domains are rapidly deployed and discarded. As of the latest assessment, ampgila.store has been taken offline, reducing immediate risk to users. However, the infrastructure may be repurposed or replaced with similar domains. Organizations and individuals are advised to block the domain and its associated IP address (192.64.117.122) at the network level. Users should verify the legitimacy of any platform claiming to be a "Global Platform" and report suspicious domains to relevant threat intelligence feeds. Proactive monitoring for newly registered domains with similar naming conventions or hosting patterns is recommended to mitigate future threats.