falas[.]pages[.]dev

This domain, falas.pages.dev, is flagged as a high-risk phishing site specifically impersonating AMLbot, a platform associated with anti-money laundering compliance tools. Analysis indicates the threat type is classified as generic_phishing, with no confirmed drainer kit observed in initial scans. The domain appears to mimic legitimate AMLbot services, likely targeting financial sector employees or compliance officers to harvest credentials or sensitive data. Infrastructure analysis reveals the following technical indicators: the domain resolves to IP 188.114.97.3, hosted by Cloudflare, Inc. in Canada. It was registered through Cloudflare, Inc. on April 20, 2026, though this creation date may reflect a placeholder or falsified record. The SSL certificate is issued by Google Trust Services (WE1), a common pattern for malicious domains leveraging legitimate CDN infrastructure. VirusTotal reports 3/95 security vendors flagging this domain as malicious. The domain appears on one security blocklist and is currently blocked by PhishDestroy. No Google Safe Browsing (GSB) status is provided, but the low detection count suggests either a newly deployed campaign or evasion techniques in use. Current status remains active, with no confirmed takedown or sinkholing observed as of this report. Response actions should include immediate blocking of the domain and IP at the network perimeter, along with monitoring for internal systems communicating with 188.114.97.3. Given the high-risk classification and impersonation of a financial compliance tool, organizations should prioritize user awareness training for employees handling AML-related workflows. Remaining risk includes potential credential theft, unauthorized access to compliance systems, or follow-on attacks leveraging stolen data. Further investigation is recommended to identify any associated phishing campaigns or secondary payload delivery mechanisms.