amlcrystal[.]org

On 29 July 2026, amlcrystal.org was observed as an active generic phishing infrastructure. The domain was registered on 10 July 2026 through the Spaceship, Inc. registrar and is served by the launch1.spaceship.net and launch2.spaceship.net authoritative nameservers. DNS resolution points to the IPv4 address 186.2.175.35. VirusTotal analysis shows that one of ninety‑one scanned security vendors flagged the domain, indicating at least a single detection.

The domain is presently listed on one external blocklist and is actively blocked by the PhishDestroy mitigation service, confirming that security‑focused entities have taken protective action. No additional public blocklists, Safe Browsing entries, or Open Threat Exchange (OTX) reports are currently associated with the domain. The site’s SSL certificate details, HTTP response code, and page title have not been disclosed in the available intelligence, leaving those aspects of the surface unknown. The limited detection footprint, combined with the recent creation date and the use of a reputable registrar, suggests a short‑lived campaign that relies on rapid deployment rather than established reputation.

Defenders should add amlcrystal.org to inbound and outbound filtering rules, monitor DNS queries for the associated IP address and nameservers, and ensure that any email or web traffic to the domain is blocked or sandboxed. Continuous re‑evaluation of VirusTotal and blocklist status is advised, as additional detections may emerge as the campaign matures. Organizations employing threat‑intel feeds should also consider correlating internal logs for any connections to 186.2.175.35 or the Spaceship nameservers to identify potential compromise attempts.