tooamls-cash[.]cfd

This domain is flagged as an elevated-risk Web3 phishing threat designed to impersonate legitimate anti-money laundering (AML) services. Analysis indicates the domain specifically targets cryptocurrency users by mimicking platforms associated with transaction security, as evidenced by the page title "AMLConnect and AMLBot: Securing Web3 Transactions Effectively." The threat type aligns with credential harvesting and fraudulent transaction redirection, common in cryptocurrency-related phishing schemes. Infrastructure analysis reveals the domain was registered on June 12, 2026, through Global Domain Group LLC and resolves to the IP address 69.67.172.176. Detection metrics show 9 out of 95 security vendors on VirusTotal flagged the domain as malicious. The domain appears on 2 security blocklists and has been blocked by multiple anti-phishing systems. A Gridinsoft trust score of 0/100 further confirms its high-risk classification. Technologies detected include Ubuntu and Apache HTTP Server, suggesting a standard but potentially vulnerable hosting environment. Mitigation steps for this threat include immediate blocking of the domain and its associated IP (69.67.172.176) at the network perimeter. Organizations should update endpoint protection rules to detect and prevent access to the domain. Cryptocurrency users should be alerted to verify the authenticity of any AML-related platforms before entering credentials or authorizing transactions. Monitoring for similar domains registered through the same registrar (Global Domain Group LLC) or resolving to the same IP range may help identify related threats. Incident response teams should review logs for any prior connections to this domain or IP to assess potential compromise.