amlservice[.]net

This domain, amlservice.net, is flagged as a high-risk brand impersonation threat specifically targeting users of the Across cryptocurrency platform. The site presents itself as an AML (Anti-Money Laundering) verification and crypto compliance check service, a common pretext used in phishing operations to harvest credentials, private keys, or other sensitive financial data from unsuspecting victims. Analysis indicates the domain is designed to exploit trust in compliance procedures, likely aiming to deceive users into disclosing authentication details or initiating fraudulent transactions under the guise of regulatory verification.

Technical indicators confirm the malicious nature of this infrastructure. The domain resolves to IP address 188.94.191.150, hosted on AS26383 (Baxet Group Inc.) in France, a network frequently associated with phishing and fraudulent activities. It was registered through NameCheap, Inc. on February 21, 2026, though the creation date appears anomalous and may indicate domain age manipulation or a typographical error in registration records. Google Safe Browsing has explicitly flagged the site as phishing. As of the latest assessment, 15 out of 95 security vendors on VirusTotal detect the domain as malicious. The domain appears on three independent security blocklists and lacks SSL certification, further reducing its legitimacy. No legitimate compliance service would operate without encryption or proper identity validation.

Despite being actively blocked by multiple security mechanisms, including browser-based protections and cryptocurrency wallet filters, the domain remains operational and accessible in some regions. The absence of SSL and the use of a high-risk hosting provider suggest low operational security, yet the site continues to pose a significant threat to users unfamiliar with phishing tactics. Users are advised to avoid interacting with the domain, verify all compliance requests through official Across channels, and report any suspicious communications. Organizations should update blocklists to include this domain and monitor for related infrastructure using the same IP range or registrar. The continued activity of amlservice.net underscores the persistent risk of brand impersonation in the cryptocurrency sector, particularly in contexts involving regulatory or compliance-themed deception.