aml-resolve[.]app

Analysis of the domain aml-resolve.app indicates it is associated with an investment scam operation, currently offline as of July 24, 2026. The domain was registered on February 21, 2026, through Dynadot LLC, and resolves to the IP address 172.86.69.234, hosted by RouterHosting LLC (AS14956) in Germany. Infrastructure analysis reveals Cloudflare nameservers (lewis.ns.cloudflare.com and rafe.ns.cloudflare.com), a common tactic to obscure hosting details and evade takedowns. No SSL certificate was detected, increasing the likelihood of unencrypted communications, which is atypical for legitimate financial or investment platforms.

Security vendor detection is limited but notable: 2 of 95 vendors on VirusTotal flagged the domain as malicious. Additionally, the domain appears on four security blocklists, including PhishDestroy, Polkadot, Enkrypt, and Codeesura. The scam classification as an 'investment scam' is supported by these blocklists, though the exact mechanics of the operation—such as targeted brands, payment methods, or social engineering tactics—remain unconfirmed due to the domain's offline status and lack of detailed page analysis. Defenders should treat this domain as high-risk for financial fraud.

Network-level blocking of 172.86.69.234 and the domain itself is recommended, along with monitoring for related infrastructure (e.g., subdomains or newly registered lookalike domains). Given the use of Cloudflare, additional scrutiny of domains sharing the same nameservers may be warranted. No evidence links this domain to a known phishing kit or specific brand impersonation at this time.