amlnow[.]com[.]au

The domain amlnow.com.au is currently active and classified as a high‑risk generic phishing operation with an investment‑scam focus. Technical analysis shows the domain resolves to IP address 65.9.175.37, hosted in Germany under ASN 16509 (Amazon.com, Inc.). The authoritative name servers are ns-1256.awsdns-29.org, ns-1639.awsdns-12.co.uk, ns-23.awsdns-02.com, and ns-915.awsdns-, indicating reliance on a cloud‑based DNS service. An Amazon‑issued RSA‑2048 M01 certificate secures the site, and HTTP response code 200 confirms the server delivers content. The page title returned is "AMLNOW — AML/CTF Compliance Platform for Australia," and the registration record lists Domain Directors Pty Ltd trading as Instra as the registrar. Infrastructure fingerprints reveal the use of Amazon Web Services, S3 storage, CloudFront CDN, and HTTP/3 protocol. The domain is blocked by PhishDestroy, appears on one security blocklist, and receives a Gridinsoft trust score of 0 / 100. VirusTotal analysis shows three of ninety‑one scanners flag the domain, reinforcing the malicious assessment. While the exact content of the landing page has not been inspected, the convergence of cloud hosting, a legitimate‑sounding title, and active blocklist entries suggests a credential‑harvesting or fraudulent investment scheme targeting users seeking AML/CTF compliance services. Defenders should add amlnow.com.au to outbound filtering rules, monitor DNS queries for the listed name servers, and consider sinkholing the IP address 65.9.175.37 to disrupt potential victim access. Continuous telemetry collection is advised to detect any evolution of the payload or additional infrastructure components.