aml-confirm[.]com

This domain, aml-confirm.com, is flagged as a generic phishing resource designed to mimic anti-money laundering (AML) verification procedures. Analysis indicates the site presents a fabricated "AML Check" interface, likely intended to harvest user credentials, financial details, or corporate compliance data. No direct association with known drainer kits or specific brand impersonation was identified, though the thematic targeting of AML processes suggests an intent to exploit regulatory compliance workflows in financial or cryptocurrency sectors. Infrastructure analysis reveals the domain was registered through MAT BAO CORPORATION on March 24, 2026, an atypical future date that may indicate falsified registration details or a typographical error. It resolves to the IP address 104.21.1.172, hosted by Cloudflare, Inc. in Canada, a common proxy service used to obfuscate malicious infrastructure. The domain appears on one security blocklist and is flagged by 17 out of 95 security vendors on VirusTotal, with no Google Safe Browsing (GSB) detections recorded. The absence of an SSL certificate further undermines its legitimacy, as modern phishing campaigns typically employ encryption to evade detection. As of the latest assessment, aml-confirm.com has been taken offline, reducing immediate exposure risks. However, the domain's registration remains active, and the infrastructure could be repurposed for future campaigns. The elevated risk level persists due to the potential for credential theft or financial fraud, particularly targeting entities subject to AML regulations. Users and organizations are advised to monitor for similar domains, enforce multi-factor authentication, and verify compliance-related communications through official channels only. The atypical registration date and Cloudflare-hosted IP warrant continued scrutiny of associated infrastructure.