alphamotionbase[.]click

On July 23, 2026, the infrastructure of alphamotionbase.click was catalogued as a high‑risk crypto scam operating under a generic phishing classification. The domain was registered through Dynadot LLC on December 04, 2025 and currently resolves to the IPv6 address 2606:4700:3034::6815:2ce8, hosted by Cloudflare, Inc. (AS13335) with the service protected by a Google Trust Services / WE1 SSL certificate. Nameserver resolution points to ajay.ns.cloudflare.com and paityn.ns.cloudflare.com, confirming Cloudflare as the underlying CDN.

An HTTP request to the host returns a 403 status code, indicating access denial, and the page title exposed by the server is "JDS Used Car Sales - Quality Used Cars," a mismatch to the reported crypto scam intent. Google Safe Browsing has flagged the domain for social engineering, and PhishDestroy has actively blocked it; the domain also appears on one additional security blocklist. VirusTotal analysis shows that thirteen of ninety‑five vendors have flagged the domain, reinforcing the malicious assessment.

While the exact phishing payload and victim interaction flow remain unverified due to the offline status, the convergence of registrar data, hosting details, SSL provenance, and multiple vendor detections provides sufficient evidence for defensive action. Security teams should add alphamotionbase.click to URL filtering and endpoint protection lists, monitor for any DNS or HTTP traffic toward the associated Cloudflare IP range, and consider sharing the indicator of compromise with threat‑intel sharing platforms to aid broader remediation efforts.