amlultra[.]com

Analysis of amlultra.com shows a newly registered domain (created 21 Feb 2026) that is currently active and serves content over HTTP without TLS. The domain is registered through Key‑Systems GmbH and uses the nameservers ns1.emailverification.info and ns2.emailverification.info. DNS resolution points to the IPv6 address 2606:4700:3032::ac43:b488, which belongs to Cloudflare, Inc. (AS13335) and is geolocated in the United States. The site returns HTTP 200 and the page title is identical to the domain name. Intelligence flags the domain as a generic phishing operation with a cryptocurrency scam focus. It appears on the PhishDestroy blocklist and has a Gridinsoft trust score of 0 / 100. VirusTotal analysis shows 8 of 93 security vendors flag the domain as malicious. The risk level is assessed as high and the status remains active. While the exact phishing payload and victim targeting have not been publicly disclosed, the combination of a fresh registration, lack of TLS, low trust score, blocklist inclusion, and multiple vendor detections strongly indicates a malicious campaign. Defenders should block the domain at network perimeter, monitor DNS queries for the associated IPv6 address, and include the domain in URL filtering policies. Additional investigation of inbound traffic for credential harvesting attempts related to cryptocurrency transactions is recommended.