trust-amlscore[.]com

This domain, trust-amlscore.com, operates as a credential theft platform targeting cryptocurrency users through fraudulent anti-money laundering (AML) verification procedures. Analysis indicates the site impersonates legitimate AML compliance services, specifically mimicking the branding and interface of AMLBot, to deceive users into submitting sensitive wallet credentials or private keys. The objective appears to be unauthorized access to cryptocurrency holdings, enabling subsequent asset drainage or account hijacking. The use of technical obfuscation and brand impersonation suggests a calculated effort to exploit trust in regulatory compliance processes within the digital asset ecosystem. Infrastructure analysis reveals multiple high-confidence indicators of malicious activity. The domain resolves to the IP address 13.248.132.87 and was registered through Ultahost, Inc. on April 16, 2026, a date inconsistent with legitimate service timelines. Detection metrics further substantiate the threat classification: the domain is flagged by 5 of 95 security vendors on VirusTotal and appears on three distinct security blocklists. Frontend technologies, including Node.js, React, Next.js, and Webpack, align with modern phishing frameworks designed to evade detection while maintaining operational scalability. The domain has been proactively blocked by multiple anti-fraud systems, including MetaMask and SEAL, reinforcing its association with credential theft operations. Users who visited trust-amlscore.com or interacted with its content should immediately revoke any permissions granted to connected wallets or applications. All credentials, private keys, or recovery phrases entered on the site must be considered compromised and should be migrated to new, secure storage. Wallet addresses associated with the domain should be monitored for unauthorized transactions, and affected users are advised to conduct a full security audit of their cryptocurrency infrastructure. Given the elevated risk level, immediate action is required to prevent asset loss, including the transfer of funds to new, unexposed wallets and the implementation of enhanced authentication controls.