amlguard[.]tools

Analysis of the domain amlguard.tools indicates a brand impersonation campaign targeting Across, a known cryptocurrency bridging service. The domain was registered on February 21, 2026, and resolves to the IP address 104.21.20.241, which is hosted on Cloudflare's infrastructure (AS13335) in the United States. As of July 23, 2026, the domain has been taken offline, though it was previously flagged by two of ninety-three security vendors on VirusTotal and appears on one security blocklist, specifically PhishDestroy. The page title associated with the domain was 'AML Guard,' suggesting an attempt to mimic anti-money laundering or wallet security features, aligning with the classified scam type of wallet or seed phishing.

The SSL certificate for the domain is issued by WE1, a provider commonly used for both legitimate and malicious sites, offering no definitive indication of intent. The domain's infrastructure, leveraging Cloudflare, is consistent with tactics used to obfuscate the true origin of phishing operations. While the domain is currently offline, the registration date and detection history suggest it was active for several months, increasing the likelihood of prior exposure to potential victims. Defenders are advised to monitor for residual traffic or references to amlguard.tools in logs, particularly those involving wallet-related interactions or communications mentioning Across.

Given the domain's presence on a security blocklist and its association with a known scam type, organizations should consider proactively blocking the domain and its resolved IP in perimeter defenses. Further investigation into related infrastructure, such as domains registered around the same date or sharing the same IP, may uncover additional components of this campaign. The exact content and functionality of the site remain unanalyzed due to its offline status, limiting conclusions about specific user interactions or payload delivery mechanisms.