audit-aml[.]app

Analysis indicates that audit-aml.app is an active phishing domain targeting cryptocurrency users, currently resolving to 216.126.229.109 (AS30823, aurologic GmbH, Germany). The domain presents itself under the page title 'AMLBot - Comprehensive Crypto Compliance Solution | Free AML Crypto Check,' suggesting a focus on crypto compliance or anti-money laundering services, though the exact content and functionality remain unverified. Infrastructure analysis reveals registration through ROUTERHOSTING (ASN: 30823) with nameservers ns1.dyna-ns.net and ns2.dyna-ns.net, a configuration consistent with known phishing operations. The domain is flagged on four security blocklists, including PhishDestroy, Polkadot, Enkrypt, and Codeesura, and holds a Gridinsoft trust score of 0/100. SSL certificate data shows 'localhost,' a non-standard and suspicious configuration often associated with malicious or hastily deployed infrastructure. As of July 12, 2026, the domain returns an HTTP 200 status, confirming active hosting. While three of 95 security vendors on VirusTotal have flagged the domain, the absence of broader detection does not preclude its malicious nature. Defenders should treat audit-aml.app as a high-risk domain, particularly in environments handling cryptocurrency transactions or compliance tools. Immediate actions include blocking the domain and IP at network perimeter controls, monitoring for connections to 216.126.229.109, and alerting users to the potential for credential harvesting or fraudulent crypto-related activity. Further investigation into the site’s functionality is recommended to determine if it operates as a crypto drainer, fake compliance tool, or other scam mechanism.