amltrustee[.]me

Analysis of the domain amltrustee.me indicates a targeted brand impersonation campaign against Trust Wallet, a cryptocurrency wallet service. The domain was registered on February 21, 2026, and resolved to the IP address 77.83.246.187, hosted under AS215540 (GLOBAL CONNECTIVITY SOLUTIONS LLP) in Poland. At the time of assessment, the domain has been taken offline, though it remains flagged by two security blocklists, including PhishDestroy and ScamSniffer. Gridinsoft assigns a trust score of 0/100, reinforcing its classification as malicious infrastructure. The page title, 'Protect your Asset's AML-Risk | Trust,' explicitly references Trust Wallet, aligning with the reported scam type of crypto fraud.

Six of 93 security vendors on VirusTotal detected the domain as malicious, though the absence of broader detection does not imply safety. The SSL certificate is issued by R12, a common certificate authority used in both legitimate and fraudulent operations, offering no definitive indication of intent. No evidence of a phishing kit or additional infrastructure links has been confirmed at this stage. Defenders should treat this domain as high-risk due to its direct impersonation of a cryptocurrency service, confirmed blocklist presence, and low trust scores.

While currently offline, the domain may reappear under the same or altered infrastructure. Monitoring for DNS reactivation, subdomain variations, or associated IP ranges (77.83.246.0/24) is recommended. If encountered in logs or proxy traffic, immediate blocking is advised. Further analysis of the hosting provider’s network may reveal additional compromised or malicious domains sharing the same ASN.