amlcryptoscan[.]net

On July 24, 2026, analysis of amlcryptoscan.net identified a confirmed brand‑impersonation campaign targeting Binance users. The site, which is currently taken offline, resolved to the IPv4 address 185.138.88.223, an address registered to Global Connectivity Solutions LLP in the Netherlands (ASN 215540). Registration records show the domain was created on 17 October 2025 through Tucows Domains Inc., and it uses Cloudflare’s authoritative nameservers fonzie.ns.cloudflare.com and lilith.ns.cloudflare.com. No TLS certificate was observed, indicating the site was served over plain HTTP.

The page title returned by the server is “AML Crypto Risk Checker for BTC, USDT, ETH, TON and other coins,” suggesting an attempt to lure victims with a purported cryptocurrency risk‑assessment tool. The domain received a Gridinsoft trust score of 0 / 100 and a Scamadviser rating of 36 / 100, reflecting a high likelihood of malicious intent. VirusTotal scans recorded three positive detections out of ninety‑five submitted security engines, and the domain appears on four independent blocklists—PhishDestroy, Polkadot, Enkrypt, and Codeesura—further corroborating its malicious status. The campaign is classified as an investment scam and explicitly impersonates Binance, aiming to convince users to submit cryptocurrency‑related information or funds.

While the site is no longer reachable, the hosting infrastructure, IP address, and associated DNS records remain active and could be reused for future campaigns. Defenders should immediately block the domain and its resolved IP, add the nameservers to threat‑intel feeds, and monitor for any re‑registration attempts. Network sensors should be configured to flag HTTP traffic to the IP without TLS, and endpoint protection solutions should incorporate the observed VirusTotal detections and blocklist entries to prevent credential or financial data compromise.