amlsecure[.]report

Analysis of amlsecure.report indicates that the domain is being used for credential phishing, specifically targeting users of anti‑money‑laundering services. The site was created on 14 December 2025 and is currently taken offline, but historical evidence shows it was actively serving malicious content. The page title observed during its active period was "The Best AML Service for Your Business - AML Secure," suggesting an attempt to lure victims with a legitimate‑sounding offering. The domain resolves to IP address 188.114.97.3, which is hosted by Cloudflare (AS13335) in the United States.

No SSL certificate was presented, leaving the connection unencrypted and making the site easier to intercept or tamper with. Reputation data is extremely poor: Gridinsoft assigns a trust score of 0 out of 100, and the domain appears on five security blocklists. Detection services have flagged the domain, with two of ninety‑five VirusTotal scanners raising alerts, and it is explicitly blocked by PhishDestroy, ScamSniffer, Polkadot, Enkrypt, and Codeesura. The registrar listed is Global Domain Group LLC, and the authoritative nameservers are augustus.ns.cloudflare.com and eve.ns.cloudflare.com.

While the exact phishing payload and credential collection mechanisms have not been captured, the combination of a targeted page title, lack of TLS, low trust rating, and multiple blocklist entries strongly indicates a credential‑phishing operation. Defenders should add amlsecure.report to firewall and proxy block lists, monitor DNS queries for the domain and its associated IP, and enforce TLS inspection policies to detect any future attempts to host similar content. Continuous observation of the Cloudflare IP range for related activity is advised, as threat actors may shift to new subdomains under the same hosting infrastructure.