amprotrd[.]pro

amprotrd.pro was observed hosting a web page titled “Evolution Global Mining – Financial Security & Reliability”. The page title suggests an attempt to masquerade as a financial services entity, which aligns with the classification of generic phishing. The domain resolves to the IPv4 address 198.251.89.220, an address assigned to AS53667 (FranTech Solutions) located in the United States. Passive DNS data shows the domain is served by the nameservers ns27.asurahosting.com and ns28.asurahosting.com, both typical of shared hosting environments.

Technical fingerprinting identified PHP, the LiteSpeed web server, and support for HTTP/3, but no TLS certificate was presented, meaning the site was reachable only over unencrypted HTTP. The domain appears on a single security blocklist and is actively blocked by the PhishDestroy feed. VirusTotal analysis returned detections from two of ninety‑five scanning engines, indicating that at least a subset of security products consider the site malicious. Registration information lists Global Domain Group LLC as the registrar; no further WHOIS details have been disclosed.

The site has since been taken offline, which limits current probing but does not negate the historical risk. Defenders should continue to enforce network‑level blocks for 198.251.89.220 and the hostnames ns27.asurahosting.com / ns28.asurahosting.com, add amprotrd.pro to URL filtering policies, and monitor for newly registered domains that reuse the same registrar or hosting provider. Given the lack of TLS and the presence of a financial‑oriented page title, users receiving unsolicited communications that reference Evolution Global Mining should be warned to verify the legitimacy of any requested credentials. Ongoing intelligence collection is recommended to confirm whether the underlying infrastructure is being reused for additional phishing campaigns.