amlhealth[.]pro

The domain amlhealth.pro has been flagged as an elevated‑risk brand impersonation site targeting the csgo brand. Infrastructure analysis shows the domain resolves to the IP address 104.21.39.10, which belongs to Cloudflare, Inc. (AS13335) and is geolocated in the United States. No SSL certificate is presented, indicating the site was served over plain HTTP before being taken offline. The page title returned by the server is "AML Check," and the site is classified as a crypto scam in the available intelligence.

Reputation scoring from Gridinsoft assigns a zero‑out‑of‑one‑hundred trust score, reflecting a high likelihood of malicious activity. VirusTotal reports that one out of ninety‑five scanned security vendors flagged the domain, providing at least one independent detection. The domain appears on two external blocklists and is explicitly blocked by the PhishDestroy and ScamSniffer services, reinforcing its malicious status. Nameserver information is not available, limiting deeper DNS‑level attribution.

The current offline status suggests the operator may have removed the site after detection, but the historical artifacts remain relevant for threat hunting. Defenders should continue to monitor for residual activity associated with the IP 104.21.39.10, add amlhealth.pro to internal deny lists, and correlate any observed traffic to known crypto‑related malicious patterns. Because the site impersonates csgo, security teams should also alert users in gaming communities about potential credential‑stealing campaigns that may have leveraged this domain before its takedown. Ongoing vigilance is advised, particularly for any re‑registration attempts or similar domains that mimic the same brand or use the same hosting infrastructure.