search-aml[.]net

The domain search-aml.net was registered through Cloudflare, Inc. on July 25 2026 and is currently resolved to the IP address 104.21.86.5. Its authoritative name servers are alexis.ns.cloudflare.com and eve.ns.cloudflare.com, indicating that the domain is hosted on Cloudflare’s edge network. The domain is classified as a generic phishing infrastructure and remains active as of the report date, July 31 2026. It has been added to a single security blocklist and is actively blocked by the PhishDestroy sink‑hole, confirming that defensive feeds have observed malicious use.

VirusTotal records show that the domain was examined by 91 scanning engines, none of which have raised a detection at the time of analysis; this absence of detections should not be interpreted as evidence of legitimacy, as many phishing sites evade static scanners. No public Safe Browsing, Open Threat Exchange, SSL certificate, HTTP response, or page‑title information is presently available, limiting the depth of technical fingerprinting. Consequently, uncertainty remains regarding the content served, the specific credential‑harvesting tactics employed, and any potential payloads delivered.

Defenders should continue to enforce blocklisting of the domain, monitor DNS queries for resolution to 104.21.86.5, and incorporate the domain into intrusion‑detection signatures. Additional telemetry, such as HTTP response codes and certificate details, should be collected if the site is accessed in a controlled environment to refine detection rules. Ongoing observation of the associated IP and Cloudflare name servers is recommended, as the infrastructure may be leveraged for further phishing campaigns.