aml-scan-wallet[.]com

aml-scan-wallet.com was registered on July 11, 2025 through MAT BAO CORPORATION. The domain resolves to the IPv4 address 198.18.2.41 and is served by Cloudflare authoritative nameservers INDIE.NS.CLOUDFLARE.COM and REESE.NS.CLOUDFLARE.COM. No TLS certificate is presented, indicating that the site is delivered over plain HTTP only. The page title returned by the server is the literal string “aml-scan-wallet.com”, providing no additional context about the service offered. Threat intelligence indicates that the domain is associated with a crypto‑drainer scam.

It appears on four independent security blocklists and is actively blocked by PhishDestroy, Polkadot, Enkrypt, and Codeesura. On VirusTotal, four out of ninety‑five scanning engines flagged the domain as malicious, reinforcing the blocklist findings. Gridinsoft assigns a trust score of 0 out of 100, the lowest possible rating, consistent with a high‑confidence malicious classification. As of the report date (July 22, 2026) the domain is listed as offline, suggesting that the operators have taken the site down or that the hosting provider has removed it. No SSL/TLS certificate, no visible content beyond the bare page title, and the lack of a public reputation score further limit the amount of observable behavior.

The absence of additional artifacts such as known phishing kits, malware payload hashes, or victim reports leaves the exact mechanism of the crypto‑drainer unverified, but the convergence of blocklist inclusion, multiple vendor detections, and a zero trust score provides strong indication of malicious intent. Defenders should continue to block traffic to 198.18.2.41 and to the fully qualified domain name aml‑scan‑wallet.com at DNS and proxy layers. Monitoring of outbound connections from internal hosts for attempts to resolve or contact this domain is advisable. Because the domain is already listed on multiple blocklists, adding it to internal deny lists will reduce exposure.