amlradar[.]org

The domain amlradar.org has been identified as a generic phishing portal designed to mimic legitimate anti-money-laundering (AML) compliance platforms. Analysis indicates this infrastructure was likely used to harvest credentials or distribute fraudulent financial alerts, though no specific financial institution or regulatory body is directly impersonated. The domain is currently offline, but prior activity suggests it targeted individuals or organizations required to comply with AML regulations, potentially exploiting urgency around compliance deadlines to prompt user interaction. Infrastructure analysis reveals the domain was registered on February 21, 2026, through CNOBIN INFORMATION TECHNOLOGY LIMITED, an entity frequently associated with high-risk registrations. It resolved to the IP address 104.21.42.191, a Cloudflare proxy endpoint commonly used to obscure hosting origins. At the time of detection, the domain was flagged by 5 of 95 security vendors on VirusTotal, with a Gridinsoft trust score of 0/100. It also appeared on one security blocklist, and its page title, 'Just a moment...', is consistent with transient or cloaked phishing pages attempting to evade automated detection. The creation date, set in the future, further suggests an attempt to bypass age-based reputation filters. Current status indicates the domain has been taken offline, likely following enforcement action or abandonment by the operators. However, the underlying infrastructure may remain active or be repurposed for similar campaigns. Organizations and individuals are advised to treat any prior interaction with this domain as a potential security incident. Network administrators should block the domain and its resolving IP at perimeter defenses, while end users should verify the legitimacy of AML-related communications through official channels only. Monitoring for related domains registered via the same registrar or resolving to the same IP range is recommended to preemptively mitigate follow-up threats.