amlgo[.]co[.]za

The domain amlgo.co.za was registered on May 23, 2023 through a local registrar and remains active as of the report date. It is listed on the PhishDestroy blocklist and appears on one additional security blocklist. The site’s page title, "AmlGo - Home," was captured during a HTTP 200 response, indicating the host is reachable and serving content.

Infrastructure analysis shows the domain resolves to the IPv4 address 23.100.48.106, which maps to an entity in Ireland under AS8075, a network owned by a major cloud provider. Four nameservers—ns1.dns-h.com, ns2.dns-h.com, ns1.host-h.net, and ns2.host-h.net—provide DNS resolution, and the MX record points to an Outlook‑based mail service (amlgo-co-za.mail.protection.outlook.com). TLS termination is performed with a certificate issued by a well‑known public certificate authority, confirming the presence of standard HTTPS encryption.

The web server stack is identified as an IIS server running on a Windows Server platform with the ASP.NET framework. Front‑end libraries include Bootstrap, Slick, and jQuery, and an analytics script is detected. These components collectively suggest a typical content‑management deployment rather than a bespoke malicious kit. VirusTotal flagged the domain in one of ninety‑five scans, providing minimal but corroborating evidence of malicious reputation.

Given the declared scam type of cryptocurrency, the high risk rating, and the active hosting of the site, defenders should block the domain at perimeter defenses and enforce DNS sink‑hole policies. Email gateways should reject or quarantine messages originating from the associated MX host. Continuous monitoring of the IP address and associated nameservers is advised, as well as periodic re‑scanning on threat‑intelligence platforms to detect any changes in the domain’s behavior or hosting environment.