# PhishDestroy threat dossier — aml-defence.click ================================================================ Fetched: 2026-07-26 14:17:48 UTC Canonical: https://phishdestroy.io/domain/aml-defence.click/ ## VERDICT ---------------------------------------------------------------- TAKEN DOWN (neutralised) Composite threat score: 72/100 (PhishDestroy scoring — see methodology below) Scam classification: AML Scam ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 2/93 security vendors flagged this domain Flagging vendors: Gridinsoft, SOCRadar Public blocklists: listed on 3 independent blocklists Victim re-reports (public form): 1 ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 172.86.66.115 (DE, Frankfurt am Main) ASN: ASAS14956 ROUTERHOSTING - RouterHosting LLC, US Hosting org: AS14956 RouterHosting LLC Registrar: Dynadot LLC Nameservers: ["ns1.dyna-ns.net", "ns2.dyna-ns.net"] Registered: 2026-02-21 Expires: 2027-02-14 Page title: Payment connector ## TLS CERTIFICATE ---------------------------------------------------------------- Issuer: cdn.jsdelivr.net Expires: 2035-07-21 Status: INVALID chain Fingerprint: c29da598ca27e274c8fb7e6768cec3974d30b49173ac6e0226b2c6ac4dbab53b ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: CLOSED — no report required. This domain was neutralised before the abuse-report cycle could be dispatched — either the hosting provider / registrar suspended it on their own, the DNS went dead, or the operator abandoned the infrastructure. PhishDestroy keeps the evidence bundle on file for audit but no formal notice was sent. ## TIMELINE ---------------------------------------------------------------- Domain registered: 2026-02-21 (per WHOIS / CT — may reflect a renewal or transfer date, not first-ever registration) First detected: 2026-02-25 02:39:27 UTC (by PhishDestroy tracker) Earliest abuse rec: 2026-02-17 04:07:14 UTC — PREDATES current WHOIS registration; retained from a previous registration cycle of the same domain name Last verified: 2026-07-26 12:21:42 UTC Neutralised: 2026-02-27 04:06:47 UTC Current status: taken down (registrar suspended or DNS dead) Note: one or more events above predate the WHOIS creation date. This typically means the same domain name was previously registered, detected, dropped, and then re-registered by a new party. PhishDestroy preserves the full historical record for operator-attribution research even when the underlying infrastructure changes hands. ## EXTERNAL CORROBORATION (third-party evidence) ---------------------------------------------------------------- URLScan.io: https://urlscan.io/result/019c6922-8651-713b-b3a2-0e8a53e9316f/ URLQuery: https://urlquery.net/report/98148b06-01f6-486a-ae7d-5b5e5afab6cd Wayback Machine: https://web.archive.org/web/*/aml-defence.click crt.sh CT logs: https://crt.sh/?q=%25.aml-defence.click Google transparency: https://transparencyreport.google.com/safe-browsing/search?url=aml-defence.click AlienVault OTX: https://otx.alienvault.com/indicator/domain/aml-defence.click URLhaus: https://urlhaus.abuse.ch/host/aml-defence.click/ ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-07-07 18:41:02 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] aml-defence.click Phishing Intelligence Report - PhishDestroy The domain aml-defence.click is a generic phishing site that poses a specific threat as a cryptocurrency phishing scam. It does not impersonate any known brand and is not associated with a drainer kit. The site is currently taken offline, indicating it has been neutralized after its malicious activity was identified. Technical indicators for aml-defence.click include detection by 2 of 95 VirusTotal vendors, specifically Gridinsoft and SOCRadar. The domain was registered through Dynadot LLC on February 21, 2026, and resolves to IP address 172.86.66.115, which is located in Germany and hosted by AS14956 RouterHosting LLC. It appears on 3 security blocklists, namely PhishDestroy, MetaMask, and SEAL. The SSL certificate is issued by cdn.jsdelivr.net, and the page title observed was 'Payment connector'. Google Safe Browsing did not flag the domain. To protect against threats from aml-defence.click, users who interacted with the site should take immediate safety steps. Since the scam type is cryptocurrency, revoke any token approvals granted to the site and move funds to a new wallet to prevent loss. Change passwords for any accounts used on the domain, enable two-factor authentication, and monitor for unauthorized transactions. Report the phishing activity to relevant authorities and blocklist maintainers to help prevent future attacks. ## EVIDENCE HASHES ---------------------------------------------------------------- PhishDestroy Case ID: PD-20260217-B97A0C TLS cert SHA-256: c29da598ca27e274c8fb7e6768cec3974d30b49173ac6e0226b2c6ac4dbab53b ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (operator takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/aml-defence.click/ JSON API: https://api.destroy.tools/v1/check?domain=aml-defence.click Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: independent open-source threat-intelligence platform. Tracked: 198,047 domains (67,366 alive under monitoring, 129,132 confirmed takedowns/dead). Site: https://phishdestroy.io