amlrisk[.]info

This domain is flagged for brand_impersonation, specifically targeting LinkedIn corporate identity and user trust mechanisms. Analysis indicates the site was designed to mimic official LinkedIn compliance or verification portals, potentially to harvest credentials or distribute malicious payloads under the guise of anti-money laundering (AML) checks. The threat type aligns with credential phishing and corporate impersonation tactics observed in enterprise-targeted campaigns. Infrastructure analysis reveals the domain amlrisk.info was registered on February 21, 2026, through GoDaddy.com, LLC, and currently resolves to IP address 172.67.170.83. The site employs Cloudflare CDN services and supports HTTP/3, suggesting modern infrastructure designed to evade detection. An SSL certificate issued by Google Trust Services provides a false sense of legitimacy. Despite zero detections on VirusTotal (0/95 engines), the domain appears on one security blocklist (PhishDestroy) and has since been taken offline. The page title, 'AML Check - The full-fledged crypto compliance solution,' directly conflicts with LinkedIn’s business model, reinforcing the impersonation vector. Mitigation requires immediate action from network security teams. Block the domain amlrisk.info and its resolving IP 172.67.170.83 at perimeter firewalls and DNS resolvers. Security teams should audit logs for connections to this domain or IP, particularly from endpoints with access to corporate credentials. User awareness training should emphasize verification of domain authenticity before entering credentials, especially for pages claiming affiliation with LinkedIn or compliance workflows. Monitor for similar impersonation domains using the seed pattern '41d57d' in registration or infrastructure metadata.