aml[.]amlguarder[.]io

This domain is flagged for elevated-risk brand impersonation targeting the CS:GO gaming community. Analysis indicates the site masquerades as an anti-money laundering (AML) suite, a tactic commonly used to deceive users into disclosing login credentials, payment details, or installing malicious software under the guise of legitimate security tools. The specific threat involves credential theft and potential financial fraud, leveraging the trust associated with the CS:GO brand to exploit victims. Infrastructure analysis reveals the domain aml.amlguarder.io was registered on March 11, 2026, through Global Domain Group LLC. It resolves to the IP address 104.21.76.169 and employs technologies including Vue.js, jsDelivr, Cloudflare Browser Insights, and Cloudflare’s HTTP/3 protocol. The domain is currently offline but was detected by 4 out of 95 security vendors on VirusTotal and appears on one security blocklist. The Gridinsoft trust score for this domain is 0/100, indicating no legitimate reputation. The SSL certificate is issued by Let’s Encrypt, a common choice for both legitimate and malicious domains due to its accessibility. Mitigation steps for this brand impersonation threat include immediate blocking of the domain and its associated IP (104.21.76.169) at the network level. Organizations should deploy indicators of compromise (IOCs) such as the domain, IP, and SSL certificate fingerprint in endpoint detection and response (EDR) systems to prevent access. Users should be educated to recognize brand impersonation tactics, particularly those involving fake security tools or AML-related services. Monitoring for similar domains registered through Global Domain Group LLC or resolving to Cloudflare IPs may help identify related threats. If credentials or financial information were entered on this site, affected accounts should be secured immediately, and transactions reviewed for unauthorized activity.