aml-tron[.]sbs

The domain aml-tron.sbs was registered on 21 February 2026. Passive DNS shows it resolving to the Cloudflare‑owned address 172.67.196.27, which is advertised as being located in the United States under ASN 13335. The domain currently returns an offline HTTP status, and the associated IP address has been added to the PhishDestroy blocklist. An SSL certificate identified as “WE1” is present, indicating the site was reachable over HTTPS before being taken down.

Intelligence sources classify the activity as a crypto‑related scam; the same classification appears in the limited blocklist entry that currently lists the domain once. VirusTotal analysis reports that two of ninety‑three scanning engines flagged the domain as malicious, confirming a detection signal but not providing a consensus. No additional reputation scores, Safe Browsing alerts, or Open Threat Exchange entries are available for this indicator.

Because the site is offline, content‑level indicators such as page title, brand targeting, or malicious payloads cannot be examined, leaving the exact phishing vector uncertain. Defenders should continue to deny any network communication to 172.67.196.27, add aml-tron.sbs to DNS‑based block lists, and monitor for any re‑use of the underlying Cloudflare IP range. Remediation actions include updating intrusion‑prevention signatures, informing end‑users about the fraudulent nature of the domain, and ensuring that security telemetry captures any future resolution attempts.