amlcrystal[.]site

Analysis of the domain amlcrystal.site indicates it was actively impersonating Google for credential phishing purposes. The domain was registered on July 11, 2025, through HOSTINGER operations, UAB, and resolved to the IP address 172.217.18.4, which is associated with AS15169 (Google LLC) in the United States. The page title was explicitly set to 'Google,' aligning with the reported brand impersonation target. Only one of 93 security vendors on VirusTotal flagged the domain at the time of assessment, though this does not rule out malicious intent given the low detection rate often observed in newly registered phishing domains.

Gridinsoft assigned a trust score of 0/100, further supporting its classification as high-risk. The domain appears on one security blocklist and was blocked by PhishDestroy, which identified it as a credential phishing operation. The SSL certificate was issued by WE1, a provider commonly used in both legitimate and malicious infrastructure. As of July 22, 2026, the domain is offline, though defenders should treat any future resolution or reactivation as suspicious.

No evidence of a phishing kit or additional page content is available in the current intelligence. Defenders are advised to block the domain at the perimeter, monitor for related IOCs (e.g., IP 172.217.18.4, SSL issuer WE1), and review logs for prior connections from internal assets. Given the domain's association with Google's infrastructure, verify whether any legitimate services were inadvertently impacted by blocking measures.