aml-scan-wallet[.]info

This domain, aml-scan-wallet.info, is currently flagged as a high-risk brand impersonation scam targeting the AML Scam brand. Created on February 21, 2026, the domain is still active and resolvable to the IP address 172.67.223.16, which is located in the United States and belongs to Cloudflare, Inc. (AS13335). The site uses Cloudflare and HTTP/3 technologies, which can obscure the true nature of the infrastructure and make it more challenging to detect and block malicious activities. While the domain’s page title indicates a '522: Connection timed out' error, this does not necessarily mean the site is down, as Cloudflare often returns this status when the origin server is unresponsive or under attack. This could be a tactic used by threat actors to avoid detection and maintain the availability of the domain for future malicious operations. Despite the error, the site’s SSL certificate is issued by Google Trust Services, which might be an attempt to instill a false sense of security in potential victims. The domain has been flagged by 3 out of 95 security vendors on VirusTotal, and it appears on four security blocklists. Additionally, the domain has been identified in seven threat intelligence pulses on AlienVault OTX, further indicating its involvement in malicious activities. Defenders should approach this domain with extreme caution, considering its high risk level and active status. It is recommended to block access to this domain and monitor any related IP addresses for signs of malicious traffic. Given the involvement of cryptocurrency, defenders should also be vigilant for any attempts to steal sensitive information or redirect users to fraudulent sites. Regular updates from threat intelligence sources and active monitoring of the domain’s activity can help mitigate potential risks.