aml-app-security-check[.]com

Analysis of aml-app-security-check.com shows a confirmed crypto‑related phishing operation that was taken offline prior to the report date of July 24, 2026. The domain was registered on March 12, 2026 through Hello Internet Corp and resolves to the Cloudflare‑hosted address 172.67.165.110, which is associated with ASN 13335 in the United States. No SSL certificate is present, indicating the site operated without HTTPS encryption.

The page title observed during the brief capture phase reads "Unlock Finance Success with AMLTestWallet," aligning with the declared scam type of a crypto scam. Infrastructure fingerprints reveal a modern JavaScript stack consisting of Node.js, Vue.js, Nuxt.js, SweetAlert2, and assets served via jsDelivr, all delivered through Cloudflare with HTTP/3 enabled. The domain appears on three public security blocklists and has been actively blocked by anti‑phishing services PhishDestroy, MetaMask, and SEAL.

VirusTotal scans report that three of ninety‑four security vendors flagged the domain, providing additional corroboration of malicious intent. While the site is currently offline, the combination of recent registration, Cloudflare hosting, lack of TLS, and the presence of a targeted page title suggests a purposeful attempt to lure victims into a fraudulent cryptocurrency wallet flow. Defenders should ensure that the domain is added to network and endpoint deny lists, monitor the associated IP range for any re‑use, and consider tightening email and web filters for similar keyword patterns such as "AMLTestWallet" or "Unlock Finance Success." Continuous observation of Cloudflare‑originated crypto‑scam domains is recommended, as threat actors frequently recycle infrastructure to evade detection.