aml-compliance[.]finance

PhishDestroy identifies the domain aml-compliance.finance as a high-risk crypto drainer kit actively distributing a sophisticated anti-money laundering (AML) compliance scam. This fraudulent site masquerades as a legitimate AML compliance portal, targeting cryptocurrency users by luring victims into connecting their wallets to a malicious smart contract. Once connected, the drainer kit silently drains token balances and transfers NFT assets to attacker-controlled wallets. The domain leverages urgency and regulatory language to deceive users into believing they must verify their wallet for compliance purposes, bypassing standard security protocols through social engineering tactics. Security researchers have confirmed this site as part of a broader campaign targeting DeFi users under the guise of regulatory compliance.

Technical analysis of aml-compliance.finance reveals several red flags consistent with active phishing infrastructure. This domain was created on April 29, 2026, and is registered through NICENIC INTERNATIONAL GROUP CO., LIMITED. It resolves to IP address 104.21.58.202 and is secured with a Let’s Encrypt SSL certificate to appear legitimate. VirusTotal analysis (3/95 security vendors) shows limited early detection, while the domain has already appeared on two major blocklists, including MetaMask and SEAL security feeds. The 3/95 detection rate highlights the evasive nature of this campaign, which exploits low initial flagging to maximize victim engagement before broader recognition occurs.

As of the latest assessment, aml-compliance.finance remains active and poses a persistent threat to cryptocurrency users. Immediate containment actions have been initiated by multiple security vendors, including MetaMask and SEAL. However, the domain continues to operate with high risk due to its recent registration, effective evasion tactics, and reliance on social engineering. Users are strongly advised to avoid interacting with any site claiming to offer AML compliance services via unsolicited links or pop-ups. Always verify URLs manually, use hardware wallet confirmation for transactions, and consult official project channels for compliance guidance. The residual risk remains elevated as threat actors may rapidly iterate on this infrastructure to bypass new detections.