amltoken[.]org

Analysis of amltoken.org confirms its classification as a high-risk crypto scam domain, now offline as of July 23, 2026. The domain was registered on February 21, 2026, through NiceNIC International Group Co., Limited, and resolved to the IP address 172.67.185.40, hosted on Cloudflare's infrastructure (AS13335) in the United States. Infrastructure analysis reveals the use of Cloudflare nameservers (mallory.ns.cloudflare.com and skip.ns.cloudflare.com), a common tactic to obscure hosting details and evade takedowns. The absence of an SSL certificate further indicates a lack of basic security measures, aligning with patterns observed in fraudulent operations.

Detection data from security vendors supports the malicious classification: 10 of 95 engines on VirusTotal flagged the domain at the time of assessment. Additionally, the domain appears on four security blocklists, including PhishDestroy, Polkadot, Enkrypt, and Codeesura, reinforcing its reputation as a threat. The page title, 'amltoken.org,' provides no additional context about the specific scam mechanics, but the scam type is explicitly categorized as a crypto scam based on available intelligence. Defenders should treat this domain as confirmed malicious.

Network-level blocking of the IP 172.67.185.40 and associated Cloudflare nameservers is recommended to prevent potential re-emergence. Organizations should also monitor for related domains registered through NiceNIC or utilizing similar Cloudflare-based infrastructure, as these may indicate further fraudulent activity. While the domain is currently offline, historical DNS records and detection data should be preserved for forensic analysis or future threat hunting efforts. The exact content of the site remains unanalyzed, but the available evidence leaves no doubt about its fraudulent nature.