amltron[.]org

This domain, amltron.org, was registered through NameCheap, Inc. on 11 February 2025 and is currently listed as offline. Authoritative DNS records point to dns1.registrar-servers.com and dns2.registrar-servers.com. The domain resolves to the IP address 66.33.60.129, which is allocated to Amazon.com, Inc. (AS16509) in the United States. No TLS certificate is presented, indicating the site is served over plain HTTP.

The only observable HTTP artifact is the page title “Vercel Security Checkpoint,” which does not reveal a legitimate brand or service and is commonly associated with placeholder or verification pages. The infrastructure received a Gridinsoft trust score of 0 out of 100 and appears on a single security blocklist. VirusTotal analysis recorded a single positive detection out of 95 scanning engines, confirming at least one vendor identified malicious behavior. PhishDestroy has also listed the domain as blocked, and the broader community classifies the activity as a crypto‑related scam under the generic phishing category.

Because the site is already taken offline, immediate containment actions focus on preventing future resurrection: add the domain and its resolving IP to outbound filtering rules, share the indicators of compromise with upstream threat‑intelligence feeds, and monitor for re‑registration or similar infrastructure reuse. Current gaps include the lack of a captured landing page, unknown victim‑targeting vector, and the exact payload or credential‑harvesting mechanism. Analysts should continue to query passive DNS, request any available web‑archive snapshots, and verify whether the single VirusTotal positive corresponds to a known phishing kit or a broader crypto‑drain module. Until further evidence emerges, the domain should be treated as a confirmed malicious artifact and blocked at the network perimeter.