amlsecure[.]live

Analysis of the domain amlsecure.live indicates it was actively involved in a credential phishing campaign targeting cryptocurrency users, classified as a crypto scam. As of July 24, 2026, the domain is offline, returning a 522 connection timeout error with the page title 'amlsecure.live | 522: Connection timed out.' Infrastructure analysis reveals the domain was registered through Cloudflare, Inc., and utilized Cloudflare nameservers (megan.ns.cloudflare.com and pedro.ns.cloudflare.com). It resolved to the IP address 188.114.97.3, associated with AS13335 (Cloudflare, Inc.) in the United States. No SSL certificate was detected for this domain.

Detection metrics from available threat intelligence sources show limited but notable flagging: 14 of 95 security vendors on VirusTotal identified the domain as malicious, and it appeared on one security blocklist, specifically PhishDestroy. Trust scores from Gridinsoft and Scamadviser both rated the domain at 1 out of 100, indicating a high-risk classification. The domain was explicitly labeled as a crypto scam in available intelligence, though the exact mechanics of the phishing operation—such as targeted brands, lure tactics, or credential harvesting methods—remain unconfirmed due to the lack of active page content for analysis. Defenders should treat this domain as a confirmed threat vector for credential theft in the cryptocurrency space.

Given its current offline status, monitoring for re-registration or DNS changes is recommended. Network-level blocking of the resolved IP (188.114.97.3) and associated Cloudflare nameservers may mitigate residual risk. The absence of an SSL certificate further aligns with typical low-effort phishing infrastructure, reinforcing the need for caution in environments where such domains may be encountered.