your-aml[.]net

This domain, your-aml.net, poses a targeted phishing threat designed to mimic legitimate anti-money laundering (AML) verification processes for cryptocurrency wallets. Analysis indicates the site likely presented users with fraudulent forms requesting wallet credentials, seed phrases, or private keys under the guise of compliance checks. Such attacks enable threat actors to drain digital assets from victims' wallets, often with irreversible consequences due to the pseudonymous nature of blockchain transactions. The site's focus on crypto wallets suggests a specialized campaign aimed at users of decentralized finance platforms or exchanges requiring AML compliance.

Infrastructure analysis reveals concrete indicators of malicious intent. The domain was registered on July 22, 2025, through Tucows Domains Inc., an unusually recent creation date for a purported compliance service. It resolved to the IP address 98.84.224.111, which has been associated with other transient phishing infrastructure. VirusTotal detection metrics show 2 out of 95 security vendors flagged the domain as malicious, a low but significant ratio given the domain's short lifespan. The site was blocked by PhishDestroy and appears on one additional security blocklist, confirming its classification as a confirmed phishing resource. The page title, 'AML Verification of Crypto Wallets,' directly matches the fraudulent pretext used to deceive targets.

Users who visited this domain should take immediate action to secure their assets. First, revoke any wallet permissions or connected applications authorized during the suspected interaction period. Monitor all linked wallets and exchange accounts for unauthorized transactions, particularly small test withdrawals that often precede larger thefts. If credentials or seed phrases were entered, migrate funds to a new wallet immediately, as the compromised wallet should be considered permanently exposed. Report the incident to relevant blockchain security teams and local cybercrime units, providing transaction hashes and timestamps if available. Enable multi-factor authentication on all crypto-related accounts, and verify future AML requests only through official channels directly accessed via bookmarked URLs or verified mobile applications.