amlscreening[.]center

This domain, amlscreening.center, presents itself as a free anti-money laundering (AML) screening service for cryptocurrency wallets but is designed to harvest wallet credentials or deploy malicious scripts. The site targets users seeking compliance checks by offering fake "Top 10 Crypto Wallet Screening Services," a common lure to trick victims into entering sensitive information or connecting wallets to malicious smart contracts. Analysis indicates this is likely a crypto drainer or credential theft operation, given the focus on wallet interactions and the absence of legitimate compliance infrastructure. Infrastructure analysis reveals the domain was registered on October 2, 2024, through Gransy, s.r.o., a registrar frequently used for newly created phishing sites. It resolves to IP address 172.67.154.91, hosted on Cloudflare’s network (AS13335), which provides anonymity and protection against takedowns. As of the latest scan, the domain has zero detections on VirusTotal (0/95), suggesting it has evaded automated detection systems. The SSL certificate is issued by Let’s Encrypt, a common choice for both legitimate and malicious sites, and the domain appears on one security blocklist, though it remains active and unflagged by most vendors. Users who visited amlscreening.center and entered wallet credentials, private keys, or connected a wallet should assume compromise. Immediately revoke any connected wallet sessions, transfer funds to a new wallet, and monitor for unauthorized transactions. If personal or financial information was submitted, enable fraud alerts on relevant accounts and report the incident to local cybersecurity authorities. Avoid interacting with the domain or any links originating from it, as it may deploy additional payloads or redirect to secondary phishing pages. Organizations should block the domain and IP at the network level to prevent further exposure.