reamll[.]com

Analysis of www.reamll.com was performed on 24 July 2026. The domain was registered on 29 April 2025 through Gname.com Pte. Ltd. and uses Cloudflare’s DNS service (aspen.ns.cloudflare.com, lynn.ns.cloudflare.com). It resolves to the IPv6 address 2606:4700:3037::ac43:bd16, a Cloudflare edge node (AS13335, United States). TLS is provided by Google Trust Services under the WE1 certificate, and the site supports HTTP/3, indicating modern web stack usage. The page title returned by the server is “AMLR&EA”, and intelligence tags the site as an investment‑scam impersonating the Across brand.

The domain appears on a single security blocklist and has been blocked by the PhishDestroy service. Gridinsoft assigns a trust score of 49 out of 100. VirusTotal analysis shows that two of ninety‑five scanners flagged the domain as malicious, corroborating the blocklist entry. The overall risk level is rated elevated, and the current operational status is offline, suggesting that takedown actions have been applied. Evidence confirms the use of legitimate CDN infrastructure to obscure the true hosting location, a common tactic for brand‑impersonation campaigns.

However, the content of the landing page beyond the title “AMLR&EA” has not been disclosed, leaving the exact phishing vector uncertain. Defenders should implement DNS‑level blocking for www.reamll.com and monitor traffic to the associated Cloudflare IPv6 range for any resurgence. Adding the domain to internal blocklists, updating web‑filter signatures, and alerting SOC teams to the Across impersonation tag are recommended. Continued vigilance on related domains registered through the same registrar or sharing the same nameservers is advised.