aml-status[.]pro

This domain, aml-status.pro, was observed delivering a crypto‑related phishing campaign. The site returned an HTTP response with the page title “Success!”, but no TLS certificate was presented, indicating that the service operated over plain HTTP only. DNS resolution points to the IPv4 address 87.120.219.250, which is allocated to AS215540 GLOBAL CONNECTIVITY SOLUTIONS LLP in the United Kingdom. The domain is hosted on Cloudflare name servers (imani.ns.cloudflare.com, andronicus.ns.cloudflare.com) and was registered on 21 February 2026 through Web Commerce Communications Limited. Reputation services assign extremely low trust scores: Gridinsoft records a 0 / 100 rating and Scamadviser a 1 / 100 rating.

The host is listed on three public security blocklists and has been explicitly blocked by PhishDestroy, MetaMask, and SEAL. VirusTotal analysis shows that six of ninety‑three scanning engines flagged the domain as malicious, corroborating its classification as a phishing vector. Open Threat Exchange (OTX) data links the domain to two separate threat‑intel pulses, further confirming its involvement in malicious activity. Technical fingerprinting reveals the presence of Nginx as the web server and the use of the jsDelivr CDN for content delivery.

Although the site is currently taken offline, defenders should continue to monitor the associated IP address and the Cloudflare name servers for any re‑activation. Immediate mitigation steps include adding the domain and its IP to blocklists, updating intrusion‑detection signatures with the observed page title and header, and enforcing DNS filtering to prevent resolution. Organizations should also educate users about unsolicited crypto‑related communications that reference “aml‑status” terminology, as the campaign appears to target cryptocurrency users. Ongoing threat‑intel feeds should be consulted for any new indicators tied to this infrastructure.