amltoken[.]top

amltoken.top was registered through Web Commerce Communications Ltd on 21 February 2026. The domain resolves to the authoritative nameservers ns100.webnic.cc. and ns101.webnic.cc., both belonging to the WebNIC hosting platform. Intelligence categorises the site as a crypto‑scam operation; no additional content analysis is available because the service has been taken offline.

VirusTotal recorded the domain in 93 antivirus and URL‑reputation engines, none of which returned a detection at the time of scanning. The same domain appears on four external blocklists and is actively blocked by the PhishDestroy, Polkadot, Enkrypt and Codeesura filtering services. No SSL certificate information, HTTP response codes, or Safe Browsing alerts have been published for the site, and no Open Threat Exchange (OTX) identifiers have been observed. Consequently, the current evidence base consists of registration metadata, nameserver configuration, blocklist presence, and the VirusTotal scan result.

Uncertainty remains regarding the actual hosting infrastructure, IP address range, and any malicious payload that may have been delivered before takedown. Defenders should add amltoken.top to internal block or deny lists, monitor DNS queries for the two WebNIC nameservers, and track any future re‑registration attempts. Continuous re‑scanning on multi‑engine platforms is recommended to capture potential changes in payload or hosting. Organizations using web filtering should ensure that the listed blocklist providers are enabled, and security teams should treat the domain as hostile until confirmed clean by additional analysis.