aml-verifier[.]com

Analysis of the domain aml-verifier.com indicates active brand impersonation targeting the Across protocol, classified as an investment scam. The domain was registered on October 13, 2025, through Porkbun LLC and currently resolves to the IP address 104.21.44.51, hosted on Cloudflare's infrastructure (AS13335). The page title 'AML Verifier' suggests an attempt to mimic compliance or verification services, aligning with the reported scam type. Detection metrics reveal limited but consistent flagging: the domain appears on four security blocklists, including MetaMask, Polkadot, PhishDestroy, SEAL, and Enkrypt, and is referenced in one AlienVault OTX threat intelligence pulse. While only three of ninety-five security vendors on VirusTotal currently flag the domain, this does not indicate safety, as detection coverage may still be developing. The domain's Scamadviser and Gridinsoft trust scores of 1/100 and 0/100, respectively, further corroborate its malicious classification. Infrastructure analysis reveals the use of Cloudflare nameservers (jean.ns.cloudflare.com and lynn.ns.cloudflare.com) and a Google Trust Services SSL certificate (WE1), which are common among both legitimate and malicious sites. The HTTP 307 status code may indicate a temporary redirect, though the destination remains unconfirmed. Defenders should treat this domain as high-risk, particularly in contexts involving cryptocurrency or financial transactions. Given its active status and confirmed blocklisting by multiple security providers, immediate inclusion in deny lists is recommended. Further investigation into the redirect chain and any associated infrastructure may reveal additional compromised or malicious domains.