aml-search[.]org

Analysis of the domain aml-search.org, created on 21 February 2026 and registered through Tucows Domains Inc., indicates an elevated-risk crypto-scam infrastructure that has been taken offline as of the report date. The domain resolves to 172.67.202.116, an address owned by Cloudflare, Inc. (AS13335) located in the United States. DNS resolution uses the Cloudflare name servers conrad.ns.cloudflare.com and frida.ns.cloudflare.com, and HTTP traffic is served over HTTP/3. The SSL certificate presented is issued by Google Trust Services under the WE1 intermediate, but the site returns the error page "526: Invalid SSL certificate," confirming that TLS negotiation fails.

The domain appears on a single public blocklist, PhishDestroy, and one of ninety-three VirusTotal scanners flagged it, reinforcing the suspicion of malicious intent. The only classified threat category supplied is "Crypto Scam," although the exact payload or victim-interaction flow has not been observed because the site is currently offline. No additional intelligence such as Safe Browsing, OTX, or malware kit identifiers is available. Defenders should continue to block the IP address 172.67.202.116 and the domain name, monitor for any re-activation of the host, and add the domain to internal deny lists.

Because the registrar is Tucows, investigators may consider requesting registration records if further attribution is required. Ongoing observation of Cloudflare-hosted infrastructure is advised, as the same IP range is frequently reused by unrelated legitimate services, raising the possibility of false positives if the domain reappears under a different name. Until the site is re-hosted, the available indicators—creation date, hosting details, SSL error, blocklist entry, and single vendor detection—constitute the complete evidence set for this threat.