amosmalware[.]run

The domain amosmalware.run was registered on February 21, 2026 through NiceNIC International Group Co., Limited and is currently resolved to the IP address 172.67.147.89, which belongs to AS13335 Cloudflare, Inc. The authoritative DNS servers are norman.ns.cloudflare.com and carrera.ns.cloudflare.com, indicating the site is hosted behind Cloudflare’s edge network. The site presents an HTTP 200 response and serves a TLS certificate issued by Google Trust Services under the WE1 name, confirming that encrypted connections are available. The page title returned from the server is "Vite + React + TS," suggesting the site is built with modern JavaScript tooling but provides no indication of the content displayed to users.

Gridinsoft assigns a trust score of 0 out of 100, and the domain appears on a single security blocklist, PhishDestroy, which has flagged it as an active threat. VirusTotal analysis shows that 2 of 93 security vendors have flagged the domain, reinforcing the presence of suspicious activity. The listed scam type is a Tech Support Scam, implying that the site likely attempts to convince victims to grant remote access or provide payment for bogus technical assistance.

However, without direct observation of the page content, the exact tactics and lure used remain uncertain. Defenders should block network traffic to the IP 172.67.147.89 and to the host name amosmalware.run at the DNS level, monitor for outbound connections that may attempt to reach the domain, and incorporate the domain into existing phishing and malware detection rules. Given the low trust score, the presence on a blocklist, and the Cloudflare‑based infrastructure, the domain should be treated as high‑risk and excluded from user‑accessible resources pending further investigation.