aml-eth[.]xyz

Analysis of aml-eth.xyz as of 29 July 2026 shows the domain is actively used for generic phishing. The domain was registered on 9 July 2026 through Spaceship, Inc. and is hosted on the IP address 186.2.175.35. Authoritative name servers are launch1.spaceship.net and launch2.spaceship.net, indicating the registrar’s own DNS infrastructure. The domain appears on a single security blocklist and is currently listed as blocked by the PhishDestroy feed.

VirusTotal scans have recorded detections from 2 of 91 security vendors, confirming that at least a minority of scanners consider the site malicious. No additional public reputation services, such as Google Safe Browsing, have been reported, and no Open Threat Exchange (OTX) pulse or similar indicator is presently associated with the domain. SSL/TLS details, HTTP response codes, and page title information have not been published, leaving the surface‑web characteristics unverified. The combination of recent creation, registrar‑controlled name servers, and early detection by multiple vendors suggests a purpose‑built phishing infrastructure rather than a compromised legitimate site.

Defenders should treat the domain as high‑risk: block the FQDN and its resolved IP at perimeter firewalls, proxy filters, and endpoint allow‑lists; add the domain to internal threat‑intel feeds; and monitor for any future DNS or certificate changes. Continuous re‑scanning with multi‑engine services is recommended to capture additional detections that may emerge as the campaign evolves. Because the site’s content and SSL configuration are not yet publicly documented, analysts should consider manual collection of HTTP headers and page metadata if safe browsing is required.