amlightning[.]click

amlightning.click is an active‑use domain that was registered on 21 December 2024 through the HOSTINGER operations, UAB registrar. The zone is delegated to the Cloudflare nameservers randall.ns.cloudflare.com and imani.ns.cloudflare.com and resolves to the IPv4 address 172.67.169.237, which belongs to AS13335 Cloudflare, Inc. No TLS certificate is presented for the host, indicating that the site was served over plain HTTP at the time of observation. The page title returned by HTTP GET requests is “Crypto Wallet AML Transaction Checker | AMLBot”, which aligns with the “Crypto Scam” classification in the supplied intelligence. The domain is explicitly listed as impersonating the LinkedIn brand, although no LinkedIn‑specific content was captured in the page title.

Detection records show that the domain appears on a single security blocklist and has been flagged by PhishDestroy. On VirusTotal the domain received a single positive detection out of ninety‑five scanners. Independent reputation scoring from Gridinsoft assigns a trust score of 0 / 100, reinforcing the malicious assessment. The overall risk rating is elevated and the operational status is reported as offline, suggesting that the malicious infrastructure has been taken down or is no longer reachable.

Evidence gaps remain: no Safe Browsing, OTX, or additional blocklist entries are documented, and the actual page content, credential collection mechanisms, or payload delivery have not been publicly disclosed. Consequently, defenders cannot confirm the exact phishing kit or the presence of malicious scripts. Nevertheless, the combination of a brand‑targeted indicator (LinkedIn), a crypto‑focused title, a low trust score, and the positive VirusTotal hit provide sufficient justification to block the domain at the network perimeter and to add the resolving IP address to deny‑lists.