verification-aml[.]live

This domain, verification-aml.live, was identified as a brand impersonation threat targeting LinkedIn users through fraudulent verification pages. The site mimics legitimate LinkedIn authentication processes to harvest credentials or distribute malware under the guise of compliance checks. The page title, NOVAPAD.io, suggests an attempt to redirect or associate with unrelated services, potentially indicating a broader campaign involving multiple fraudulent endpoints. Analysis indicates the domain was registered through Cloudflare, Inc., and resolves to the IP address 104.21.3.73. It is flagged by 7 out of 95 security vendors on VirusTotal, with a Gridinsoft trust score of 0/100. The domain appears on 2 security blocklists and is actively blocked by PhishDestroy and ScamSniffer. Technologies detected include Cloudflare infrastructure and HTTP/3, which may be leveraged to obfuscate malicious activity or evade detection. Users who visited verification-aml.live should immediately revoke any sessions associated with the site, reset credentials for LinkedIn and any other services where the same password was reused, and scan their systems for malware. Network-level blocking of the domain and its associated IP (104.21.3.73) is recommended to prevent further exposure. If financial or sensitive data was entered, monitor accounts for unauthorized activity and report the incident to relevant fraud response teams.