detectivpro[.]app

The domain detectivpro.app was registered on February 21, 2026 through NameCheap, Inc. and is currently taken offline, returning no HTTP response. DNS resolution points to IP address 81.19.140.231, which belongs to ASN 215540 (GLOBAL CONNECTIVITY SOLUTIONS LLP) located in Canada. No SSL/TLS certificate is presented for the host, indicating that any attempt to establish an encrypted session would fail. The site’s page title, as observed in prior crawls, reads “DetectivPro | AML Check,” suggesting an attempt to masquerade as a service related to AMLBot.

The domain is explicitly listed as impersonating the AMLBot brand and is classified as an investment‑scam variant of brand impersonation. Infrastructure analysis shows the domain uses generic registrar‑provided nameservers dns1.registrar-servers.com and dns2.registrar-servers.com, a common pattern among rapidly provisioned malicious sites. Detection signals include placement on five independent security blocklists—PhishDestroy, ScamSniffer, Polkadot, Enkrypt, and Codeesura—demonstrating consensus among threat‑intel feeds that the domain is malicious. VirusTotal scans report that two of ninety‑three security vendors flagged the domain, providing additional independent confirmation of suspicious activity.

While the exact payload or phishing page content has not been captured, the combination of brand impersonation, investment‑scam labeling, blocklist presence, and lack of TLS creates a high‑confidence indicator of malicious intent. Defenders should add detectivpro.app to web‑filter and endpoint blocklists, monitor DNS queries for the domain and its associated nameservers, and consider the hosting IP 81.19.140.231 as a potential indicator of compromise for network traffic analysis. Given the offline status, any future re‑activation should trigger immediate quarantine. Continuous re‑scanning of the domain and its IP, along with verification against updated blocklists, is recommended to maintain situational awareness.