a-m-l-scan[.]net

This domain, a-m-l-scan.net, is currently flagged as a generic phishing threat designed to mimic anti-money laundering (AML) verification systems. Analysis indicates the site was operational under the page title 'Trust AML,' suggesting an intent to impersonate legitimate financial compliance platforms. As of the latest assessment, the domain has been taken offline, though prior infrastructure analysis reveals concerning indicators. Infrastructure analysis reveals the domain was registered on May 15, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com, a registrar frequently associated with high-risk domains. It resolves to the IP address 104.21.94.6, which is part of a network range commonly used for content delivery but also observed in phishing campaigns. Despite zero detections from 95 VirusTotal vendors, the domain appears on three independent security blocklists, indicating prior malicious activity. Notably, the absence of an SSL certificate further undermines any claim to legitimacy, as modern financial services universally enforce encrypted connections. Current status confirms the domain is offline, reducing immediate risk to end users. However, the technical indicators—including the recent creation date, blocklist presence, and lack of encryption—warrant continued monitoring. Organizations should proactively block the domain and associated IP at the network level, while financial institutions are advised to alert customers about potential AML-themed phishing attempts. If the domain reactivates, security teams should treat it as a confirmed phishing resource and prioritize forensic analysis of its infrastructure.