scamaltman[.]lol

This domain, scamaltman.lol, is currently active and hosts a site titled “$SCAM Claim Portal”. The site returns HTTP 200 and serves a TLS certificate from a public certificate authority, indicating encrypted traffic. DNS resolution points to 104.21.39.239, an address owned by ASN 13335, a large content‑delivery network operating in the United States. The domain was registered on 28 April 2026 through a registrar linked to Global Domain Group LLC and uses two nameservers that resolve to the same CDN provider. Technical fingerprinting shows the presence of HTTP/3, HSTS and browser‑insight scripts supplied by the CDN, confirming the use of modern web protocols. VirusTotal analysis shows a single detection out of 91 scanners, and the domain appears on three external blocklists. The risk rating is high and the threat type is classified as generic phishing. At present, no additional content or payload details have been disclosed, so the exact malicious behavior (e.g., credential harvesting) remains unverified. Defenders should block all traffic to this hostname at perimeter devices, add the domain to internal DNS blacklists, and monitor for any outbound connections from internal hosts to the resolved IP address. Continuous re‑evaluation is advised to capture any changes in payload or infrastructure.