amlmiks[.]com

Analysis indicates that amlmiks.com was registered on 2025-12-03 through PDR Ltd. d/b/a PublicDomainRegistry.com and was hosted on TIMEWEB infrastructure in Russia (AS9123). The domain resolved to IP 185.200.242.199, which is associated with the TIMEWEB network and served via the DDoS‑Guard mitigation service. The site presented the page title “AML Check” and employed a Let’s Encrypt R12 certificate, suggesting a publicly trusted TLS layer. Email services were configured with MX records pointing to mx1.timeweb.ru and mx2.timeweb.ru.

The domain is currently listed as offline, but historical observations show it was blocked by multiple independent filters, including PhishDestroy, MetaMask, and SEAL, and appears on three external security blocklists. VirusTotal scans recorded detections from two of ninety‑five scanners, reinforcing the malicious classification. The intelligence categorizes the operation as an investment‑type scam, aligning with the “AML Check” title that may have been used to lure victims into providing personal or financial information.

No additional content, HTTP status codes, or payload samples are available, leaving the exact phishing methodology unconfirmed. Defenders should continue to deny network connections to 185.200.242.199, enforce domain‑level blocking for amlmiks.com across DNS and proxy layers, and monitor the registrar and nameserver records for any re‑registration attempts. Adding the domain to internal blocklists and sharing the indicators of compromise with threat‑sharing communities will help mitigate potential resurgence.