aml-info[.]app

The domain aml-info.app was registered on 2026-02-21 through PDR Ltd. d/b/a PublicDomainRegistry.com and is presently taken offline, returning a 522 Connection timed out page title. Infrastructure analysis shows the domain resolves to 104.21.80.1, an IP address owned by Cloudflare, Inc. (AS13335) located in the United States. DNS records list the authoritative nameservers gigi.ns.cloudflare.com and viddy.ns.cloudflare.com, and the site employs Cloudflare’s HTTP/3 protocol.

The SSL certificate presented is issued by SSL Corporation under the Cloudflare TLS Issuing ECC CA 3 chain, confirming the use of Cloudflare’s managed TLS service. Threat intelligence flags the domain as a crypto‑related scam; it appears on four independent blocklists—PhishDestroy, Polkadot, Enkrypt, and Codeesura—and two of ninety‑three VirusTotal scanners have flagged it as malicious. No additional content has been captured, and the page itself is not reachable, limiting visual or functional analysis.

The primary uncertainty lies in the specific phishing payload or lure, as the site’s content has not been harvested before the takedown. Defenders should block the domain and its associated IP at the network perimeter, add the resolver nameservers to DNS filtering policies, and monitor for any resurgence of the same IP or Cloudflare‑hosted assets. Continuous re‑scanning of the domain on VirusTotal and inclusion in internal threat‑intel feeds are recommended to capture future changes in detection scores.