amlviewer[.]org

This domain, amlviewer.org, is identified as a high-risk phishing infrastructure impersonating Anti-Money Laundering (AML) compliance portals. Analysis indicates the site mimics legitimate AML viewer interfaces, likely targeting financial institutions, compliance officers, or cryptocurrency platforms to harvest credentials or sensitive data. No specific drainer kit has been conclusively linked to this domain at this time, though the generic_phishing classification suggests broad credential theft objectives rather than a specialized attack chain. Infrastructure analysis reveals the domain was registered on June 21, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com. It resolves to the IP address 188.114.96.3 and is flagged by 4 out of 95 security vendors on VirusTotal. The domain appears on two security blocklists and has been documented in one AlienVault OTX threat intelligence pulse. Google Safe Browsing status remains unconfirmed, but the presence on multiple blocklists and vendor detections underscores its malicious intent. As of the latest assessment, amlviewer.org remains active, posing an ongoing threat to users. Immediate response actions include blacklisting the domain and IP across security gateways, notifying affected industries, and monitoring for related infrastructure. Despite these measures, the domain's continued operation and low detection rate among vendors (4/95) indicate residual risk. Organizations are advised to block access, educate users on recognizing phishing attempts, and implement multi-factor authentication to mitigate credential theft risks.