amxwallet[.]cz

On 24 July 2026, the domain amxwallet.cz was identified as an offline site that previously hosted a brand‑impersonation page targeting Amazon. The page title “Amazon Pre‑Sale for AMX (up to 200% bonus)” directly references the Amazon brand and advertises a cryptocurrency offering, which aligns with the classified “Crypto Scam” type. DNS resolution points to 172.67.151.139, an address owned by AS13335 Cloudflare, Inc. in the United States. No SSL certificate was presented, indicating the site operated over plain HTTP and preventing encrypted‑traffic inspection.

Reputation services assigned extremely low scores: Scamadviser recorded a trust score of 1 / 100 and Gridinsoft reported 0 / 100. The domain is listed as blocked by PhishDestroy and appears on one external security blocklist. VirusTotal analysis flagged the domain with detections from ten of ninety‑five scanning engines, reinforcing the malicious assessment. Nameserver information is unavailable, and the current offline status limits direct observation of the page content.

The convergence of a brand‑specific title, cryptocurrency lure, low trust scores, multiple vendor detections, and blocklist inclusion suggests a coordinated attempt to deceive Amazon users into transmitting funds or personal data. Defensive actions should include adding amxwallet.cz to URL filtering and endpoint deny lists, monitoring the Cloudflare‑owned IP 172.67.151.139 for related activity, and updating detection signatures to flag the exact page‑title string. Continuous re‑evaluation is recommended in case the domain is re‑activated or its infrastructure is repurposed for new campaigns.