amlusdtchecker[.]com

The domain amlusdtchecker.com was registered through MAT BAO CORPORATION and created on March 08, 2025. Infrastructure analysis shows it resolves to the IP address 188.114.96.3, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. The domain is currently offline, but historical data indicates it was serving a page titled "Nur einen Moment…" without an SSL certificate, suggesting unencrypted HTTP delivery. Security telemetry records the domain on one public blocklist and confirms it is blocked by the PhishDestroy service.

VirusTotal scans returned five positive detections out of ninety‑five AV engines, reinforcing the malicious classification. Gridinsoft assigned a trust score of 0 out of 100, indicating a high confidence of abuse. The nameservers observed are CLAY.NS.CLOUDFLARE.COM and ELAINE.NS.CLOUDFLARE.COM, consistent with the hosting provider. The threat type is identified as a crypto scam, but no further behavioral details such as payload, credential‑stealing forms, or targeted cryptocurrency wallets have been disclosed.

Consequently, the primary unknowns are the exact content of the page, the victim acquisition vector, and any post‑compromise activity that may have been attempted. Defensive actions should include immediate addition of amlusdtchecker.com to DNS and web‑proxy deny lists, verification that outbound traffic to the hosting IP is monitored, and continuation of blocklist propagation to peer organizations. Given the lack of TLS, any inadvertent connections would occur over cleartext, so enforcing HTTPS inspection where permissible can aid detection. Continuous re‑query of reputation services is advised in case the domain is re‑activated or re‑used by the same threat actors.