aml-check[.]us

This domain, aml-check.us, poses as a legitimate anti-money laundering (AML) verification service to deceive users into submitting wallet credentials or sensitive financial information. The site specifically targets cryptocurrency users by presenting a fake "Wallet Check" interface, likely designed to harvest private keys, seed phrases, or login details under the guise of compliance checks. Such scams are commonly used to drain funds from digital wallets or gain unauthorized access to financial accounts. Analysis indicates this infrastructure is actively malicious despite its low detection rate. The domain currently resolves to IP address 138.124.59.95 and uses a Let's Encrypt SSL certificate to appear legitimate. VirusTotal scans show 0 detections out of 95 security engines, suggesting the threat is either new or employs evasion techniques to avoid automated detection. The page title "Wallet Check" and the domain name itself are crafted to mimic official AML verification processes, increasing the likelihood of successful deception. If you visited aml-check.us or entered any information on the site, immediately disconnect the device from the internet to prevent further data transmission. Do not reuse any credentials submitted to the site; change passwords for all financial accounts, especially cryptocurrency wallets. Monitor linked accounts for unauthorized transactions and consider revoking access to any connected applications. Report the incident to relevant financial institutions and file a complaint with cybercrime authorities. Avoid interacting with the domain or its associated IP address in the future, as it remains an active threat.