policy-aml[.]app

This domain, policy-aml.app, was identified as part of a high-risk phishing infrastructure linked to an investment scam. Registered on February 21, 2026, through Dynadot LLC, the domain resolved to the IP address 172.86.69.234, hosted by FranTech Solutions in Germany. Analysis of its nameservers (ns1.dyna-ns.net and ns2.dyna-ns.net) and hosting provider aligns with patterns observed in fraudulent financial schemes. As of July 25, 2026, the domain has been taken offline, though it remains flagged by multiple security vendors.

Eleven of ninety-three security vendors on VirusTotal classified policy-aml.app as malicious, and it appears on four blocklists, including PhishDestroy, Polkadot, Enkrypt, and Codeesura. AlienVault OTX also lists the domain in a threat intelligence pulse, further corroborating its association with phishing activity. The page title, matching the domain name, provides no additional brand-specific context, and no phishing kit or targeted brand was explicitly identified in available data. The scam type was classified as an investment scam based on existing threat intelligence, though the exact mechanics of the operation remain unconfirmed.

Defenders should treat this domain as compromised infrastructure. While currently offline, its prior use in fraudulent activity warrants continued monitoring for re-emergence or related domains. Network-level blocking of the resolved IP (172.86.69.234) and associated nameservers may mitigate residual risk. Organizations should review logs for connections to this domain or IP, particularly in financial or investment-related contexts, and correlate findings with other indicators from AlienVault OTX and blocklist sources.