amlscoreslookup[.]com

Analysis of the domain amlscoreslookup.com indicates it is actively involved in fraudulent activity classified as an investment scam. Registered on April 16, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, the domain remains operational as of July 12, 2026, despite being flagged by one security blocklist and two of 91 security vendors in recent scans. Infrastructure analysis reveals the domain resolves to IP address 104.21.55.243, hosted on Cloudflare's network (AS13335) in the United States. The site employs Cloudflare's nameservers (magnolia.ns.cloudflare.com and skip.ns.cloudflare.com) and utilizes HTTP/3 protocol, with a Let's Encrypt SSL certificate issued under the identifier YE1. Current HTTP responses return a 403 status code, and the only visible page title is 'Just a moment...', suggesting either a holding page or automated filtering mechanism. The specific nature of the scam—whether targeting cryptocurrency investments, stock trading platforms, or other financial instruments—remains unconfirmed due to limited visible content. No brand impersonation or specific kit has been identified in the available data. Defenders should treat this domain as high-risk, particularly in financial sectors, and consider blocking or monitoring traffic to 104.21.55.243. The short registration window (under three months) and use of Cloudflare infrastructure are consistent with patterns observed in transient phishing operations. Further investigation into associated email addresses, WHOIS history, or linked infrastructure may provide additional indicators of compromise.