aml-rank[.]com

This domain is flagged as an elevated-risk generic phishing threat designed to mimic anti-money laundering (AML) verification portals. Analysis indicates the infrastructure is engineered to harvest credentials or distribute fraudulent compliance requests, a tactic commonly observed in financial sector impersonation schemes. The domain exhibits multiple high-confidence indicators of malicious intent, warranting immediate caution for users and organizations in regulated industries. Infrastructure analysis reveals the following technical indicators: the domain was registered on March 28, 2026, through Metaregistrar BV, a registrar frequently associated with high-risk registrations. It resolves to the IP address 172.67.147.173, a host with a history of hosting phishing content. Detection metrics show 12 out of 95 security vendors on a major threat intelligence platform flagged the domain as malicious. The domain appears on one security blocklist and was identified in a single threat intelligence pulse on a collaborative threat-sharing platform. Additionally, it has been actively blocked by at least one security provider, further corroborating its malicious classification. The domain is currently offline, which may indicate takedown efforts or a temporary cessation of operations by the threat actor. Mitigation steps specific to this threat type include immediate blocking of the domain and its associated IP address (172.67.147.173) at the network perimeter. Organizations should implement strict email filtering rules to quarantine messages containing references to aml-rank.com or similar AML-themed domains. Employees in compliance, finance, and legal departments should be briefed on the risks of fake AML verification portals, emphasizing the importance of verifying requests through official channels. Security teams are advised to monitor for lateral movement or credential misuse in cases where users may have interacted with the domain. Proactive threat hunting should focus on logs containing the domain name, IP address, or related indicators to identify any prior compromise. Given the domain's registration date in the future (2026), this anomaly should be treated as a red flag for fraudulent activity.