amlraportes[.]com

Analysis of amlraportes.com shows a short-lived domain created on 21 February 2026 and registered through GoDaddy.com, LLC. The site was identified as an investment‑type phishing operation, with the page title “AML Check – The full‑fledged crypto compliance solution”, a phrasing commonly used to lure victims interested in cryptocurrency compliance. The domain resolves to IP address 77.105.139.98, which belongs to AS216071 SERVERS TECH FZCO located in the Netherlands. The hosting infrastructure uses a Let’s Encrypt R11 certificate, indicating the operator obtained a free TLS certificate to lend the site a veneer of legitimacy. Both authoritative nameservers ns29.domaincontrol.com and ns30.domaincontrol.com are standard GoDaddy controls, confirming the registrar’s involvement.

Two of ninety‑three VirusTotal scanners flagged the domain, and the site appears on a single external security blocklist. PhishDestroy has taken the domain offline, and its current HTTP status is reported as taken offline. Despite the offline state, the observed indicators suggest the domain was actively used for an investment‑scam campaign targeting cryptocurrency users. No additional public intelligence such as OTX references or Safe Browsing alerts were found.

Defenders should block DNS resolution to 77.105.139.98 and add amlraportes.com to URL filtering lists. Monitoring of GoDaddy‑registered domains that share the same nameserver pair and similar creation dates may help identify related infrastructure. Because the site employed a legitimate‑looking TLS certificate, reliance on certificate validation alone is insufficient; threat‑intel feeds that capture the domain’s detection count and blocklist status provide a more reliable early warning. Continued observation of the IP range associated with AS216071 is recommended to catch any re‑deployment of the phishing infrastructure.