amlriskscoreanalysis[.]ru

Analysis of amlriskscoreanalysis.ru shows a high‑risk generic phishing operation tied to an investment‑scam theme. The domain was registered on 24 March 2026 through REGRU-RU and uses the registrar’s default nameservers (ns1.reg.ru, ns2.reg.ru). DNS resolves to IP 216.198.79.1, which is geolocated to the United States and associated with Lefkoff Industries. The site presents a TLS certificate issued by Let's Encrypt (R12) and enforces HSTS, indicating a deliberately secured front end. Infrastructure fingerprints reveal deployment on Vercel and a HTTP 307 redirect, a pattern often used to hide the final landing page. Threat intelligence platforms have flagged the domain: three of ninety‑four VirusTotal scanners reported malicious activity, Gridinsoft assigns a trust score of 0/100, and the domain appears on one external blocklist. PhishDestroy has already blocked the site, confirming active mitigation by at least one security vendor. While the exact page content has not been examined, the presence of the page title "AML Checker Pro" aligns with the advertised investment‑scam narrative. Uncertainties remain regarding the full scope of the phishing kit and any credential‑harvesting mechanisms. Defenders should add amlriskscoreanalysis.ru to block lists, monitor outbound connections to 216.198.79.1, and deploy URL filtering rules that capture the 307 redirect pattern. Continuous re‑scanning with multi‑engine services is advised to capture any evolving indicators.