aml[.]crypto-host[.]xyz

The domain aml.crypto-host.xyz, associated with a high threat score of 75/100, presents itself as a phishing site impersonating "across." The site is currently down, indicating it has been taken down or is no longer operational. VirusTotal reports that 4 out of 95 security vendors have flagged this domain as malicious, including recognizable names like Forcepoint ThreatSeeker and Fortinet, while it is listed on one public blocklist. Google Safe Browsing has not flagged the domain.

No registrar information is available, suggesting potential use of privacy protection or that the data has been scrubbed. The domain was created on 2026-02-21 and was first detected in the database on 2026-02-26. Given its high threat score and malicious detection, block the domain at the perimeter and monitor the associated IP 104.21.43.252 as an indicator of compromise.