amlprotect[.]co[.]uk

Analysis as of July 19, 2026 indicates that the domain amlprotect.co.uk is actively being used in an investment‑scam campaign. The site returns HTTP 200, confirming that a web service is reachable. The domain has been referenced in four AlienVault OTX threat‑intel pulses, demonstrating that multiple researchers have observed activity linked to it. VirusTotal scans show two of ninety‑one security vendors flagging the domain, suggesting at least a minimal detection of malicious behavior. It is listed on one public blocklist and is currently blocked by the PhishDestroy filtering service, providing additional confirmation of its abusive nature. The campaign is classified as an investment scam, though the specific tactics, victim targeting, or monetary demands have not been publicly disclosed. No further details about the hosting infrastructure, IP address, or registration data are available in the current intelligence set, leaving those aspects uncertain. Defenders should block or sinkhole the domain at network perimeter, monitor DNS queries for amlprotect.co.uk, and incorporate the indicator into threat‑intel feeds. Continuous re‑evaluation is advised as further telemetry may emerge.