amlpro[.]business

The domain amlpro.business was observed hosting a page titled “AML Crypto Risk Checker for BTC, USDT, ETH, TON and other coins”. The site was taken offline prior to the report date of 25 July 2026, but archival data shows it returned HTTP 200 and presented a TLS certificate issued by Google Trust Services under the “WR2” profile. Registration was completed on 12 December 2025 through Tucows Domains Inc., and the authoritative nameservers are kim.ns.cloudflare.com and nero.ns.cloudflare.com, indicating the use of Cloudflare’s DNS service. DNS resolution points to IP 213.176.19.37, which is announced by AS207713 (GLOBAL INTERNET SOLUTIONS LLC) and geolocated to Russia.

The domain appears on two public blocklists, including PhishDestroy and ScamSniffer, and has been flagged by four of ninety‑three VirusTotal scanners, reinforcing its malicious classification. The page’s headline and the supplied “Investment Scam” label suggest a crypto‑investment bait, likely aimed at unsuspecting users seeking AML compliance checks. No additional technical artefacts such as malicious payloads, exploit kits, or credential‑stealing forms have been publicly disclosed, leaving the exact phishing mechanics uncertain. Defenders should add amlpro.business to domain‑block lists, enforce network‑level deny rules for its IP address, and monitor Cloudflare‑associated DNS queries for similar patterns.

Continuous monitoring of the associated ASN (AS207713) for new domains resolving to the same host is advised, as threat actors often reuse infrastructure. Updating URL filtering and reputation services with the observed page title can improve detection of future clones. Because the site is already offline, incident response teams should focus on preventing re‑use of the same hosting and certificate assets, and consider threat‑intel sharing with peers to raise awareness of this specific investment‑fraud vector.