m[.]amvbiz[.]com

Analysis of m.amvbiz.com shows a short‑lived phishing infrastructure that was taken offline before the report date of July 24, 2026. The domain was registered on March 12, 2026 through Tucows Domains Inc. and is delegated to the Cloudflare nameservers keenan.ns.cloudflare.com and kelly.ns.cloudflare.com. DNS resolution points to 172.67.166.216, an IP address owned by Cloudflare, Inc. (AS13335) and located in the United States. The site presented an SSL certificate issued by Google Trust Services under the WE1 label, indicating use of Cloudflare’s SSL termination.

Technical fingerprints captured by passive scans reveal the presence of ECharts, Vue.js, jQuery, Cloudflare Browser Insights and HTTP/3, all of which are common in modern web applications and do not by themselves indicate malicious intent. The page title returned by the server is "AMV"; no further content analysis is available, so the exact phishing lure or credential‑stealing page cannot be confirmed. The domain appears on a single security blocklist and has been actively blocked by PhishDestroy. VirusTotal contributed a single positive detection out of 94 scanned engines, demonstrating that at least one scanner identified suspicious behavior.

The combination of recent registration, rapid takedown, Cloudflare hosting, and limited detection coverage suggests a fast‑flux style deployment intended to evade long‑term tracking. Defenders should add m.amvbiz.com to URL filtering and DNS blocklists, monitor traffic to its resolving IP 172.67.166.216 for anomalous patterns, and enforce strict TLS verification to prevent man‑in‑the‑middle attempts that could exploit the same certificate chain. Because the underlying hosting provider is a legitimate CDN, additional scrutiny of other domains sharing the same IP may be warranted. Continuous re‑evaluation of the domain’s status is advised, as re‑use of the IP address by other malicious actors remains possible.