shieldwatch[.]live

The domain shieldwatch.live was registered on March 22 2026 through Hostinger operations, UAB and uses the default Hostinger nameservers ns1.dns-parking.com and ns2.dns-parking.com. DNS resolution points to the IPv4 address 82.29.191.201, which is geolocated to the United Kingdom and is hosted on Hostinger's GB infrastructure. The site served content built with Tailwind CSS, LiteSpeed web server, jsDelivr CDN and advertised HTTP/3 support, but it did not present an SSL/TLS certificate at the time of observation, indicating plain HTTP delivery. The page title returned by the server was “AMLBot”, which does not correspond to any known legitimate brand and aligns with the listed scam type of an investment scam. A Gridinsoft trust score of 0 out of 100 further confirms the malicious nature of the host.

The domain appears on a single public blocklist and is actively blocked by the PhishDestroy feed. VirusTotal analysis recorded three positive detections out of ninety‑four scanners, corroborating its classification as malicious. The site status is currently offline, which limits real‑time content inspection, but historical evidence points to a phishing‑style infrastructure targeting investors. Uncertainty remains regarding the exact payload or credential‑harvesting mechanisms because the live page was not captured before takedown.

No TLS certificate, no HTTPS redirection, and the lack of additional observable indicators such as malware downloader URLs prevent deeper payload attribution. Defenders should continue to block the domain at perimeter filters, update DNS sinkhole entries for 82.29.191.201, and monitor for any re‑registration attempts by the same registrar. Threat intelligence feeds should be enriched with the observed technology stack and the “AMLBot” page title to aid correlation with future campaigns. Incident response teams should treat any emails or messages referencing shieldwatch.live as malicious and advise users to avoid interaction.