aml-chains[.]one

Analysis of the domain aml-chains.one shows a short-lived infrastructure associated with an investment-themed phishing campaign. The domain was registered on 21 February 2026 through Dynadot LLC and is served by the authoritative name servers ns1.dyna-ns.net and ns2.dyna-ns.net. DNS resolution points to the single IPv4 address 172.86.66.224, which is geolocated to Germany and listed under the organization FranTech Solutions. The host appears on four public security blocklists and is specifically blocked by PhishDestroy, Polkadot, Enkrypt, and Codeesura.

VirusTotal records indicate that 12 of 93 scanned security vendors flagged the domain, reinforcing its malicious classification. The site was also referenced in one AlienVault OTX pulse, providing additional community-based corroboration. The page title returned by the server is “aml-chains.one”, but no further content has been harvested; the current operational status is offline, suggesting the site has been taken down or is otherwise inaccessible. Despite the offline state, the observed artifacts – registration details, name-server configuration, hosting IP, blocklist presence, and multiple vendor detections – constitute concrete evidence of a phishing infrastructure targeting investors.

Defenders should continue to enforce blocklist rules for the domain and the associated IP, monitor any future DNS changes, and consider adding the host to internal deny lists. Incident response teams should also watch for repeat use of the same registrar or name-server pair in new campaigns, as the pattern may indicate a reusable malicious provisioning pipeline. Because the site is no longer reachable, active takedown verification is not possible, but the historical data should be retained for attribution and threat-intel enrichment.