amlwex[.]com

On 24 July 2026 the domain amlwex.com was flagged as a crypto‑related phishing site and is currently listed as offline. The registration record shows the domain was created on 21 February 2026 through Web Commerce Communications Limited dba WebNic.cc, and it uses the authoritative nameservers ns100.webnic.cc and ns101.webnic.cc. DNS resolution points to the IP address 104.21.32.1, which belongs to Cloudflare, Inc. (AS13335) and is geolocated in the United States. The TLS certificate presented for the host is identified as “WE1”, indicating a generic or possibly self‑signed certificate rather than a brand‑validated credential.

The domain appears on one security blocklist and is explicitly blocked by the PhishDestroy feed, confirming that at least one reputable anti‑phishing provider has taken action against it. VirusTotal scans show that five of ninety‑five antivirus or URL‑filter engines flagged the domain, providing additional independent corroboration of malicious intent. The risk rating assigned by the reporting system is “elevated”, reflecting the combination of recent creation, association with a crypto scam, and confirmation from multiple detection sources. Evidence beyond the listed indicators is not publicly available; no Safe Browsing, Open Threat Exchange, or page‑title information has been disclosed, and the site itself is not reachable for content analysis.

Consequently, defenders cannot confirm the exact phishing payload or lure used, only that the infrastructure aligns with typical crypto‑phishing campaigns that leverage Cloudflare’s CDN to mask origin. Recommendations include adding amlwex.com to inbound and outbound deny lists, monitoring DNS queries for the associated IP and nameservers, and employing sink‑hole or proxy controls to capture any residual traffic. Continuous re‑evaluation is advised in case the domain is re‑activated or the underlying infrastructure is repurposed for new attacks.