aml-cash[.]info

On 25 July 2026 the domain aml-cash.info was observed in an elevated‑risk brand‑impersonation campaign targeting the CSGO brand. The site was hosted behind Cloudflare’s network (ASN 13335) and resolved to the IPv4 address 172.67.137.199, which is geolocated to the United States. The domain was registered through Cloudflare, Inc., and uses the Cloudflare nameservers moura.ns.cloudflare.com and olga.ns.cloudflare.com. No TLS certificate was presented; the service responded without HTTPS, indicating a lack of transport‑layer encryption. VirusTotal records show that seven of ninety‑five security vendors flagged the domain as malicious, and the domain appears on a single external blocklist.

PhishDestroy also listed the domain as blocked. AlienVault OTX reported the domain in one threat‑intelligence pulse, and Gridinsoft assigned a trust score of 0 out of 100, reflecting a highly suspicious reputation. The page title returned by the HTTP response is “AML Bot”, and the campaign is classified as a crypto‑scam, with the brand target identified as CSGO. The domain’s current status is offline, preventing direct content inspection. The available evidence confirms that the infrastructure is deliberately obscured behind Cloudflare, that the domain has attracted multiple vendor detections, and that it is already being blocked by at least two security services.

Uncertainty remains regarding the exact content that was served before the takedown, as well as any additional command‑and‑control infrastructure that may have been associated with the campaign. Defenders should continue to monitor the domain’s DNS records for re‑activation, ensure that any outbound traffic to 172.67.137.199 is blocked at the network perimeter, and consider adding the domain to internal blocklists. Given the lack of TLS, any attempted connections would be vulnerable to interception; enforcing HTTPS‑only policies would mitigate potential credential capture.