amltrust[.]live

PhishDestroy identifies amltrust.live as a live credential theft scam targeting unsuspecting users through impersonation of a trust platform. This domain was flagged by only 2 out of 95 VirusTotal security vendors but remains active and dangerous, operating under a recently registered name designed to deceive visitors. The domain resolves to IP 104.21.73.228 and holds a Google Trust Services SSL certificate, which may lull users into a false sense of security by appearing legitimate at first glance.

Evidence supporting the elevated risk includes the domain's recent creation on October 03, 2025—merely days old—and its registration through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar with no distinguishing reputation for security oversight. With only 2 out of 95 VirusTotal vendors detecting malicious activity, this low detection rate underscores the stealthy nature of the scam, making it likely to evade automated filters and ensnare users who do not manually verify site authenticity. The domain’s recent creation and low blocklist presence suggest it is part of a larger campaign rapidly evolving to exploit trust in new domains.

If you have visited amltrust.live, cease any interaction immediately and revoke any credentials entered on the site. Scan your devices for malware using reputable antivirus software and change passwords for affected accounts from a separate, trusted device. Avoid entering sensitive information on any untrusted domain and verify URLs through independent sources. Report this domain to your security team or relevant abuse channels to help mitigate further spread.