aml-finance[.]net

Analysis of aml-finance.net indicates that the domain was registered through NiceNIC International Group Co., Limited on October 12, 2025 and is currently taken offline. The domain resolves to the Cloudflare-hosted address 188.114.96.3, which is located in the United States and belongs to ASN 13335 operated by Cloudflare, Inc. No SSL certificate was presented on the host, meaning HTTPS connections would be unavailable or untrusted. The authoritative nameservers are arely.ns.cloudflare.com and david.ns.cloudflare.com, both typical of Cloudflare‑managed domains. The site’s sole observable page title is "Web3 AML Checker", and the domain is documented as impersonating the professional network brand LinkedIn.

Threat intelligence classifies the activity as a crypto‑related scam, and the domain appears on a single external blocklist and has been blocked by the PhishDestroy service. VirusTotal scanning recorded five detections out of ninety‑five vendor scans, confirming that multiple security engines have identified malicious behavior. The lack of an SSL certificate also prevents collection of certificate metadata that could aid fingerprinting. Although the site is offline, the combination of a recent registration, Cloudflare infrastructure, absence of TLS, and a page title referencing anti‑money‑laundering checks suggests an attempt to lure cryptocurrency users by masquerading as a LinkedIn‑related service.

Defenders should continue to monitor the IP address 188.114.96.3 for any re‑use, enforce blocklisting of the domain in corporate web filters, and consider adding the associated nameservers to threat‑intelligence feeds. At this time the exact phishing page content cannot be verified because the site is offline, and no HTTP response headers are available; the precise lure and credential‑capture mechanisms remain unknown. Further investigation should focus on any future re‑activation of the domain or related sub‑domains that may employ the same Cloudflare assets.