aml-wallet[.]one

Analysis of the domain aml-wallet.one shows a newly registered web property created on 23 March 2026. The domain is registered through Dynadot Inc and uses the authoritative name servers ns1.dyna-ns.net and ns2.dyna-ns.net. The site presents a TLS certificate issued by Let’s Encrypt (expiration E8) and returns HTTP 200 for requests, indicating an operational web server. The hosting resolves to the IPv4 address 172.86.70.33, which is geolocated to Germany and associated with the organization FranTech Solutions. Network services appear to be powered by an Ubuntu operating system running Node.js, React, Next.js and Nginx, with front‑end assets bundled by Webpack. The page title reported by crawlers is “AMLBot - Comprehensive Crypto Compliance Solution | Free AML Crypto Check”, suggesting the site pretends to offer compliance tooling for cryptocurrency transactions. Threat intelligence flags the domain as a high‑risk brand‑impersonation campaign targeting the AML Scam brand. Gridinsoft assigns a trust score of 0/100, and VirusTotal records 16 of 95 security vendors labeling the domain as malicious. The domain is listed on one public blocklist and is actively blocked by PhishDestroy. The combination of a fresh registration, low trust score, and multiple vendor detections underlines a concerted effort to lure victims into a cryptocurrency‑related scam. Defenders should incorporate the IOCs – domain aml-wallet.one, IP 172.86.70.33, and the associated Let’s Encrypt certificate – into perimeter defenses and DNS filtering solutions. Continuous monitoring of traffic to the observed IP range and the Dynadot name server set is advised. Given the active status, incident response teams should treat any interaction with the site as compromised and advise users to avoid providing credentials or financial information.