aml-scan.org: Fake AML Scanner Site Exposed

PhishDestroy identifies aml-scan.org as a brand impersonation phishing site targeting AML Scam users, leveraging a deceptive scanner interface to harvest credentials. The domain, registered on May 05, 2026, resolves to IP 104.21.94.128 and operates under CNOBIN INFORMATION TECHNOLOGY LIMITED via Let’s Encrypt SSL. No drainer kit artifacts were detected during static analysis, suggesting a lightweight, social-engineering-driven operation designed to trick victims into submitting sensitive information under the guise of an ‘AML compliance scan.’ This domain exhibits minimal technical sophistication but carries high risk due to its direct impersonation of a legitimate brand. VirusTotal currently shows 1/95 detection, indicating it remains under the radar of major security engines. The domain was registered through CNOBIN INFORMATION TECHNOLOGY LIMITED, points to IP 104.21.94.128, and uses a Let’s Encrypt certificate issued shortly after creation. Google Safe Browsing (GSB) has not yet flagged it, and no third-party blocklists include it, leaving users vulnerable to first-seen attacks. The May 05, 2026 registration date suggests a recently deployed campaign likely targeting crypto or financial compliance sectors. As of now, aml-scan.org remains active and unblocked across major platforms. Immediate remediation is recommended: block the domain at DNS/network level, flag the IP (104.21.94.128), and update browser blocklists. Users should avoid visiting the site and verify any ‘AML scan’ requests directly through official AML Scam channels. While the threat is currently low in detection coverage, its potential for credential theft and brand erosion makes it a high-risk impersonation site requiring urgent attention. Remaining risk is high due to unflagged status and active operation.