aml-trc20[.]xyz

Analysis indicates that the domain aml-trc20.xyz was registered through Spaceship, Inc. on July 09, 2026 and is currently resolving to the IPv4 address 186.2.175.35. The authoritative name servers for the zone are launch1.spaceship.net and launch2.spaceship.net, both of which are operated by the same registrar. The domain appears on a single security blocklist and is actively flagged by the PhishDestroy service. VirusTotal reports that two out of ninety-one scanning engines have classified the domain as malicious, which aligns with the blocklist observation. The domain is listed as a generic phishing threat, and its risk level is reported as high.

The infrastructure suggests a rapid deployment pattern, with creation and first detection occurring within days of each other. Uncertainty remains regarding the content hosted at the address, as no page title, SSL certificate details, or HTTP response codes have been disclosed in the available intelligence. Likewise, the absence of additional vendor detections or broader blocklist coverage limits the ability to assess the full scope of the campaign. The limited number of detections may reflect early-stage activity or a low-profile hosting configuration.

Defenders should treat aml-trc20.xyz as hostile. Network sensors should block outbound connections to 186.2.175.35 and any sub-domains resolved from launch1.spaceship.net or launch2.spaceship.net. Email gateways should deny messages that contain URLs pointing to this domain. Continuous monitoring of threat-intel feeds for new detections or expanded blocklist listings is recommended, as further indicators may emerge as the campaign progresses.