ltc-amm[.]net

ltc-amm.net was registered on 13 November 2025 through Gname.com Pte. Ltd. and currently resolves to 104.21.46.207, an IP owned by Cloudflare (AS13335, United States). The site returns HTTP 200 and presents a page titled “b2c2: One-Stop Global Investment Platform | Forex | Commodities | Stocks | Indices | Cryptocurrencies | Gold | Oil”, mimicking legitimate investment services. Its TLS certificate is issued by Google Trust Services under the WE1 name, and HSTS is enforced. Infrastructure analysis shows the domain is served behind Cloudflare’s edge network, using HTTP/3 and Cloudflare Browser Insights. Front‑end assets are built with Vue.js, indicating a modern web application framework. Nameservers ace.ns.cloudflare.com and raquel.ns.cloudflare.com confirm the reliance on Cloudflare DNS. Threat intelligence flags ltc-amm.net as a high‑risk brand‑impersonation campaign. VirusTotal records 2 detections out of 95 scanners, and AlienVault OTX references the domain in two separate pulses. The domain appears on three public blocklists and has been listed by PhishDestroy, MetaMask, and SEAL as malicious. Gridinsoft assigns a trust score of 0/100, reinforcing the malicious classification. While the current page content focuses on investment offerings, no additional malicious payloads have been observed, leaving the full scope of the fraud uncertain. Defenders should block the domain at the DNS and proxy layers, monitor outbound connections to the Cloudflare IP, and enforce email filtering for messages that reference the site’s branding. Continuous re‑analysis is advised, as the operators may later inject credential‑harvesting forms or redirect victims to payment portals.