cryptoaml[.]live

cryptoaml.live is observed hosting a counterfeit Google landing page that promotes a cryptocurrency scheme. The domain was registered on March 01, 2026 through Global Domain Group LLC and remains active as of July 12, 2026. The site returns HTTP 200 and presents a page title of “Google”, directly mimicking the brand’s visual identity. The threat classification is brand impersonation with a high risk rating. Infrastructure analysis reveals the domain resolves to IP 172.253.122.147, which belongs to AS13335 Cloudflare, Inc. The authoritative nameservers are melissa.ns.cloudflare.com and bjorn.ns.cloudflare.com, indicating use of Cloudflare’s DNS and CDN services. The TLS certificate is issued by Google Trust Services under the WE1 label, a legitimate certificate chain that can be leveraged to increase user confidence. Technical profiling shows the presence of jsDelivr, Cloudflare Browser Insights, and HTTP/3, all typical of modern web delivery stacks but not indicative of malicious code on their own. The site’s Gridinsoft trust score is 0 out of 100, and VirusTotal has flagged the domain by one of ninety‑five security vendors. It is listed on a single security blocklist and has been actively blocked by PhishDestroy, confirming that security providers have identified it as abusive. The content aligns with a cryptocurrency scam, using the Google brand to lure victims. Defenders should add cryptoaml.live to URL filtering and DNS block lists across enterprise perimeter and endpoint solutions. Monitoring for TLS certificates issued by Google Trust Services on unrelated domains can help surface similar abuse. Because the domain relies on Cloudflare’s network, traffic may be mixed with legitimate services; carving out the specific IP 172.253.122.147 or the exact host header can reduce false positives. Continuous threat‑intel feeds should be consulted for any future re‑registration attempts, and any observed traffic should be logged for forensic analysis.