aml-trust[.]pro

This domain, aml-trust.pro, is identified as a generic phishing threat designed to impersonate anti-money laundering (AML) compliance portals. Such domains typically aim to harvest credentials, financial data, or sensitive corporate information by mimicking legitimate regulatory or financial institution interfaces. The infrastructure is often used in targeted campaigns against financial sector employees, compliance officers, or individuals involved in transaction monitoring systems. Analysis of the domain's behavior suggests it may have been part of a broader credential theft operation, though its current offline status limits further interaction-based investigation. Evidence supporting the malicious classification includes detection by 7 out of 95 security vendors on VirusTotal, with the domain appearing on at least one security blocklist. Registered through DevExpanse Ltd d/b/a Regery.com on October 12, 2025, the domain resolves to the IP address 109.172.86.227. The page title '403 Forbidden' indicates either a misconfigured server or an attempt to evade automated scanners by restricting access. The domain's creation date aligns with recent phishing campaign trends, where newly registered domains are rapidly deployed and discarded to avoid detection. Users who visited aml-trust.pro should immediately revoke any credentials entered on the site, particularly those related to financial or compliance systems. Monitor accounts associated with the compromised credentials for unauthorized access or transactions. If corporate systems were accessed via this domain, initiate an internal security review to assess potential data exposure. Network administrators should block the domain and its resolving IP (109.172.86.227) at the perimeter to prevent further interaction. Given the elevated risk level, affected organizations should consider implementing additional authentication measures, such as multi-factor authentication, for critical systems.